Sps spoofing detection

ABSTRACT

A method of detecting an anomalous SPS signal includes determining whether a first SPS signal is anomalous by determining: whether an actual SPS signal measurement difference is consistent with an expected measurement difference; whether a received power of the first SPS signal exceeds a maximum expected power; whether the first SPS signal originated from an SV location consistent with first SV location information; whether a first pseudorange to a first SV differs by more than a first pseudorange threshold from an expected pseudorange; that a first location, based on the first SPS signal measurement corresponds to at least one of an unexpected location or a high likelihood of anomaly location; whether one or more base station signal measurements are consistent with a first SPS signal measurement; and/or whether a measured signal quality of the first SPS signal is consistent with an expected signal quality.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims the benefit of U.S. Provisional Application No.63/013,695, filed Apr. 22, 2020, entitled “SPS SPOOFING DETECTION,”which is assigned to the assignee hereof, and the entire contents ofwhich are hereby incorporated herein by reference for all purposes.

BACKGROUND

Obtaining a reliable, accurate location of one or more mobile devicesmay be useful for many applications including, for example, emergencycalls, personal navigation, asset tracking, locating a friend or familymember, etc. Existing positioning methods include methods based onmeasuring radio signals transmitted from a variety of devices orentities including satellite vehicles (SVs) and terrestrial radiosources in a wireless network such as base stations and access points.It is expected that standardization for the 5G (Fifth Generation)wireless networks will include support for various positioning methods,which may utilize reference signals transmitted by base stations in amanner similar to which LTE (Long-Term Evolution) wireless networkscurrently utilize Positioning Reference Signals (PRS) and/orCell-specific Reference Signals (CRS) for position determination.

SUMMARY

An example user equipment includes: an SPS receiver (SatellitePositioning System receiver) to receive satellite positioning systemsignals including a first SPS signal; a memory; and a processorcommunicatively coupled to the memory and to the SPS receiver, toreceive SPS signals from the SPS receiver, and configured to: determinewhether the first SPS signal is anomalous by being configured to atleast one of: (1) determine a first SPS signal measurement of the firstSPS signal, a first format of the first SPS signal corresponding to afirst SV (satellite vehicle); determine a second SPS signal measurementof a second SPS signal, the second SPS signal being separate from thefirst SPS signal, and a second format of the second SPS signalcorresponding to a second SV; and determine whether an actualmeasurement difference between the first SPS signal measurement and thesecond SPS signal measurement is consistent with an expected measurementdifference between expected SPS signals from the first SV and the secondSV; or (2) determine whether a received power of the first SPS signalexceeds a maximum expected SPS signal received power; or (3) determinewhether the first SPS signal originated from an SV location consistentwith first SV location information for the first SV comprising firstephemeris data for the first SV, first orbital information for the firstSV, or a combination thereof; or (4) determine whether a firstpseudorange, based on the first SPS signal, to the first SV differs bymore than a first pseudorange threshold from an expected pseudorange tothe first SV based on a time-filtered location of the user equipmentdetermined by the processor; or (5) determine that a first location, ofthe user equipment, based on the first SPS signal measurementcorresponds to at least one of an unexpected location or a highlikelihood of anomaly location; or (6) determine whether one or morebase station signal measurements are consistent with the first SPSsignal measurement; or (7) a measured signal quality of the first SPSsignal is consistent with an expected signal quality.

Implementations of such a user equipment may include one or more of thefollowing features. To determine whether the first SPS signal isanomalous, the processor is configured to determine whether an actualpower difference between a first power of the first SPS signalmeasurement and a second power of the second SPS signal measurementdiffers from an expected power difference by more than a first powerthreshold. The processor is configured in accordance with (1) and isconfigured to select the first SPS signal and the second SPS signal suchthat: the first SPS signal has a first carrier frequency, the second SPSsignal has a second carrier frequency that is different from the firstcarrier frequency, and the first SV and the second SV are the same SV;or the first SV is in a separate constellation from the second SV. Theprocessor is configured in accordance with (1) and is configured todetermine the expected measurement difference based on the first SVlocation information for the first SV and based on second SV locationinformation for the second SV. To determine whether the first SPS signalis anomalous, the processor is configured to determine whether an actualpseudorange difference, between the first pseudorange based on the firstSPS signal and a second pseudorange based on the second SPS signal,differs from an expected pseudorange difference by more than a secondpseudorange threshold. The processor is configured in accordance with(1), the first SPS signal measurement is a first time, and the secondSPS signal measurement is a second time. The processor is configured torespond to an initial determination that the first SPS signal isanomalous by determining whether the first SPS signal is anomalous basedon a third SPS signal that is different from any SPS signal on which theinitial determination was based. The processor is configured to selectthe third SPS signal such that a third format of the third SPS signalcorresponds to a third SV that is part of a satellite vehicleconstellation that excludes the first SV.

Also or alternatively, implementations of such a user equipment mayinclude one or more of the following features. The processor isconfigured to respond to determining that the first SPS signal isanomalous by determining whether the first SPS signal is anomalous basedon at least one technology other than SPS technology. The processor isconfigured to determine at least one of how many other SV signals orwhat other technologies to use based on a security level of knowledge ofa position of the user equipment.

Also or alternatively, implementations of such a user equipment mayinclude one or more of the following features. The user equipmentincludes at least one motion sensor communicatively coupled to theprocessor, and the processor is configured to determine, based on atleast one sensor measurement from the at least one motion sensor, adead-reckoning position of the user equipment and to determine whetherthe first SPS signal is anomalous in response to at least one of thefirst SPS signal measurement and the second SPS signal measurement beinginconsistent with the dead-reckoning position of the user equipment. Theprocessor is configured to respond to determining that the first SPSsignal is anomalous by at least one of: disregarding the first SPSsignal to determine a position of the user equipment; or disregardingthe first pseudorange based on the first SPS signal to determine theposition of the user equipment; or de-weighting the first SPS signal todetermine the position of the user equipment; or de-weighting the firstpseudorange based on the first SPS signal to determine the position ofthe user equipment; or using the one or more base station signalmeasurements to determine the position of the user equipment; orincreasing one or more weightings of the one or more base station signalmeasurements to determine the position of the user equipment; or sendingan anomaly indication, indicating that the first SPS signal isanomalous, to a first network entity; or sending a set of SPS signalmeasurements to a second network entity.

Another example user equipment includes: signal receiving means forreceiving SPS signals including a first SPS signal; and anomaly meansfor determining whether the first SPS signal is anomalous, the anomalymeans comprising at least one of: measurement difference means for:determining a first SPS signal measurement of the first SPS signal fromthe signal receiving means and having a first format corresponding to afirst SV; determining a second SPS signal measurement of a second SPSsignal from the signal receiving means and having a second formatcorresponding to a second SV; and determining whether an actualmeasurement difference between the first SPS signal measurement and thesecond SPS signal measurement is consistent with an expected measurementdifference between expected SPS signals from the first SV and the secondSV; or expectation means for determining whether a received power of thefirst SPS signal exceeds a maximum expected SPS signal received power;or origination means for determining whether the first SPS signaloriginated from an SV location consistent with first SV locationinformation for the first SV comprising first ephemeris data for thefirst SV, first orbital information for the first SV, or a combinationthereof; or pseudorange means for determining whether a firstpseudorange, based on the first SPS signal, to the first SV differs bymore than a first pseudorange threshold from an expected pseudorange tothe first SV based on a time-filtered location of the user equipment; orlocation/likelihood means for determining that a first location, of theuser equipment, based on the first SPS signal measurement corresponds toat least one of an unexpected location or a high likelihood of anomalylocation; or means for determining whether one or more base stationsignal measurements are consistent with the first SPS signalmeasurement; or means for determining whether a measured signal qualityof the first SPS signal is consistent with an expected signal quality.

Implementations of such a user equipment may include one or more of thefollowing features. The anomaly means comprise the measurementdifference means, and the measurement difference means are fordetermining whether an actual power difference between a first power ofthe first SPS signal measurement and a second power of the second SPSsignal measurement differs from an expected power difference by morethan a first power threshold. The user equipment comprises themeasurement difference means and the measurement difference means arefor selecting the first SPS signal and the second SPS signal such that:the first SPS signal has a first carrier frequency, the second SPSsignal has a second carrier frequency that is different from the firstcarrier frequency, and the first SV and the second SV are the same SV;or the first SV is in a separate constellation from the second SV. Theuser equipment comprises the measurement difference means and themeasurement difference means are for determining the expectedmeasurement difference based on the first SV location information forthe first SV and based on second SV location information for the secondSV. The anomaly means comprise the measurement difference means, and themeasurement difference means are for determining whether an actualpseudorange difference, between the first pseudorange based on the firstSPS signal and a second pseudorange based on the second SPS signal,differs from an expected pseudorange difference by more than a secondpseudorange threshold. The anomaly means comprise the measurementdifference means, the first SPS signal measurement is a first time, andthe second SPS signal measurement is a second time. The anomaly meansare for responding to an initial determination that the first SPS signalis anomalous by determining whether the first SPS signal is anomalousbased on a third SPS signal that is different from any SPS signal onwhich the initial determination was based. The anomaly means are forselecting the third SPS signal such that a third format of the third SPSsignal corresponds to a third SV that is part of a satellite vehicleconstellation that excludes the first SV.

Also or alternatively, implementations of such a user equipment mayinclude one or more of the following features. The anomaly means are forresponding to an initial determination that the first SPS signal isanomalous by determining whether the first SPS signal is anomalous basedon at least one technology other than SPS technology. The anomaly meansare for determining at least one of how many other SV signals or whatother technologies to use based on a security level of knowledge of aposition of the user equipment.

Also or alternatively, implementations of such a user equipment mayinclude one or more of the following features. The anomaly meanscomprise the measurement difference means, and the measurementdifference means are for determining a dead-reckoning position of theuser equipment, and wherein the anomaly means are for determiningwhether the first SPS signal is anomalous in response to at least one ofthe first SPS signal measurement and the second SPS signal measurementbeing inconsistent with the dead-reckoning position of the userequipment. The user equipment includes at least one of: positiondetermination means for determining a position of the user equipment byresponding to determining that the first SPS signal is anomalous by atleast one of: disregarding the first SPS signal to determine theposition of the user equipment; or disregarding the first pseudorangebased on the first SPS signal to determine the position of the userequipment; or de-weighting the first SPS signal to determine theposition of the user equipment; or de-weighting the first pseudorangebased on the first SPS signal to determine the position of the userequipment; or using the one or more base station signal measurements todetermine the position of the user equipment; or increasing one or moreweightings of the one or more base station signal measurements todetermine the position of the user equipment; or first sending means forresponding to determining that the first SPS signal is anomalous bysending an anomaly indication, indicating that the first SPS signal isanomalous, to a first network entity; or second sending means forresponding to determining that the first SPS signal is anomalous bysending a set of SPS signal measurements to a second network entity.

An example method of detecting an anomalous SPS signal includes:receiving, at a user equipment, a first SPS signal; and determining, atthe user equipment, whether the first SPS signal is anomalous by atleast one of: determining whether an actual measurement difference,between a first SPS signal measurement of the first SPS signal and asecond SPS signal measurement of a second SPS signal, is consistent withan expected measurement difference between expected SPS signals from afirst SV (satellite vehicle) and a second SV, wherein the first SPSsignal has a first format corresponding to the first SV and the secondSPS signal has a second format corresponding to the second SV; ordetermining whether a received power of the first SPS signal exceeds amaximum expected SPS signal received power; or determining whether thefirst SPS signal originated from an SV location consistent with first SVlocation information for the first SV comprising first ephemeris datafor the first SV, first orbital information for the first SV, or acombination thereof; or determining whether a first pseudorange, basedon the first SPS signal, to the first SV differs by more than a firstpseudorange threshold from an expected pseudorange to the first SV basedon a time-filtered location of the user equipment; or determining that afirst location, of the user equipment, based on the first SPS signalmeasurement corresponds to at least one of an unexpected location or ahigh likelihood of anomaly location; or determining whether one or morebase station signal measurements are consistent with the first SPSsignal measurement; or determining whether a measured signal quality ofthe first SPS signal is consistent with an expected signal quality.

Implementations of such a method may include one or more of thefollowing features. Determining whether the first SPS signal isanomalous comprises determining whether the actual measurementdifference is consistent with the expected measurement difference bydetermining whether an actual power difference between a first power ofthe first SPS signal measurement and a second power of the second SPSsignal measurement differs from an expected power difference by morethan a first power threshold. Determining whether the first SPS signalis anomalous comprises determining whether the actual measurementdifference is consistent with the expected measurement difference, themethod further comprising selecting the first SPS signal and the secondSPS signal such that: the first SPS signal has a first carrierfrequency, the second SPS signal has a second carrier frequency that isdifferent from the first carrier frequency, and the first SV and thesecond SV are the same SV; or the first SV is in a separateconstellation from the second SV. Determining whether the first SPSsignal is anomalous comprises determining whether the actual measurementdifference is consistent with the expected measurement difference, themethod further comprising determining the expected measurementdifference based on the first SV location information for the first SVand based on second SV location information for the second SV.Determining whether the first SPS signal is anomalous comprisesdetermining whether the actual measurement difference is consistent withthe expected measurement difference by determining whether an actualpseudorange difference, between the first pseudorange based on the firstSPS signal and a second pseudorange based on the second SPS signal,differs from an expected pseudorange difference by more than a secondpseudorange threshold. The method comprises determining whether theactual measurement difference is consistent with the expectedmeasurement difference, the first SPS signal measurement is a firsttime, and the second SPS signal measurement is a second time. The methodincludes responding to an initial determination that the first SPSsignal is anomalous by determining whether the first SPS signal isanomalous based on a third SPS signal that is different from any SPSsignal on which the initial determination was based. The method includesselecting the third SPS signal such that a third format of the third SPSsignal corresponds to a third SV that is part of a satellite vehicleconstellation that excludes the first SV.

Also or alternatively, implementations of such a method may include oneor more of the following features. The method includes responding to aninitial determination that the first SPS signal is anomalous bydetermining whether the first SPS signal is anomalous based on at leastone technology other than SPS technology. The method includesdetermining at least one of how many other SV signals or what othertechnologies to use, for determining whether the first SPS signal isanomalous, based on a security level of knowledge of a position of theuser equipment.

Also or alternatively, implementations of such a method may include oneor more of the following features. The method comprising determining adead-reckoning position of the user equipment, and determining whetherthe first SPS signal is anomalous is performed in response to at leastone of the first SPS signal measurement and the second SPS signalmeasurement being inconsistent with the dead-reckoning position of theuser equipment. The method comprising responding to determining that thefirst SPS signal is anomalous by at least one of: disregarding the firstSPS signal to determine a position of the user equipment; ordisregarding the first pseudorange based on the first SPS signal todetermine the position of the user equipment; or de-weighting the firstSPS signal to determine the position of the user equipment; orde-weighting the first pseudorange based on the first SPS signal todetermine the position of the user equipment; or using the one or morebase station signal measurements to determine the position of the userequipment; or increasing one or more weightings of the one or more basestation signal measurements to determine the position of the userequipment; or sending an anomaly indication, indicating that the firstSPS signal is anomalous, to a first network entity; or sending a set ofSPS signal measurements to a second network entity.

An example non-transitory, processor-readable storage medium includesprocessor-readable instructions configured to cause a processor of auser equipment to: determine whether a first SPS signal is anomalous bycausing the processor to at least one of: (1) determine a first SPSsignal measurement of the first SPS signal, a first format of the firstSPS signal corresponding to a first SV; determine a second SPS signalmeasurement of a second SPS signal, the second SPS signal being separatefrom the first SPS signal, and a second format of the second SPS signalcorresponding to a second SV; and determine whether an actualmeasurement difference between the first SPS signal measurement and thesecond SPS signal measurement is consistent with an expected measurementdifference between expected SPS signals from the first SV and the secondSV; or (2) determine whether a received power of the first SPS signalexceeds a maximum expected SPS signal received power; or (3) determinewhether the first SPS signal originated from an SV location consistentwith first SV location information for the first SV comprising firstephemeris data for the first SV, first orbital information for the firstSV, or a combination thereof; or (4) determine whether a firstpseudorange, based on the first SPS signal, to the first SV differs bymore than a first pseudorange threshold from an expected pseudorange tothe first SV based on a time-filtered location of the user equipmentdetermined by the processor; or (5) determine that a first location, ofthe user equipment, based on the first SPS signal measurementcorresponds to at least one of an unexpected location or a highlikelihood of anomaly location; or (6) determine whether one or morebase station signal measurements are consistent with the first SPSsignal measurement; or (7) determine whether a measured signal qualityof the first SPS signal is consistent with an expected signal quality.

Implementations of such a storage medium may include one or more of thefollowing features. The instructions configured to cause the processorto determine whether the first SPS signal is anomalous compriseinstructions configured to cause the processor to determine whether anactual power difference between a first power of the first SPS signalmeasurement and a second power of the second SPS signal measurementdiffers from an expected power difference by more than a first powerthreshold. The instructions configured to cause the processor todetermine whether the first SPS signal is anomalous in accordance with(1), and wherein the instructions comprise instructions configured tocause the processor to select the first SPS signal and the second SPSsignal such that: the first SPS signal has a first carrier frequency,the second SPS signal has a second carrier frequency that is differentfrom the first carrier frequency, and the first SV and the second SV arethe same SV; or the first SV is in a separate constellation from thesecond SV. The instructions configured to cause the processor todetermine whether the first SPS signal is anomalous in accordance with(1), and wherein the instructions comprise instructions configured tocause the processor to determine the expected measurement differencebased on the first SV location information for the first SV and based onsecond SV location information for the second SV. The instructionsconfigured to cause the processor to determine whether the first SPSsignal is anomalous comprise instructions configured to cause theprocessor to determine whether an actual pseudorange difference, betweenthe first pseudorange based on the first SPS signal and a secondpseudorange based on the second SPS signal, differs from an expectedpseudorange difference by more than a second pseudorange threshold. Theinstructions comprise the instructions configured to cause the processorto determine whether the first SPS signal is anomalous by causing theprocessor to determine whether the actual measurement difference betweenthe first SPS signal measurement and the second SPS signal measurementis consistent with the expected measurement difference, the first SPSsignal measurement is a first time, and the second SPS signalmeasurement is a second time. The instructions comprise instructionsconfigured to cause the processor to respond to an initial determinationthat the first SPS signal is anomalous by determining whether the firstSPS signal is anomalous based on a third SPS signal that is differentfrom any SPS signal on which the initial determination was based. Theinstructions comprise instructions configured to cause the processor toselect the third SPS signal such that a third format of the third SPSsignal corresponds to a third SV that is part of a satellite vehicleconstellation that excludes the first SV.

Also or alternatively, implementations of such a storage medium mayinclude one or more of the following features. The instructions compriseinstructions configured to cause the processor to respond to determiningthat the first SPS signal is anomalous by determining whether the firstSPS signal is anomalous based on at least one technology other than SPStechnology. The instructions comprise instructions configured to causethe processor to determine at least one of how many other SV signals orwhat other technologies to use based on a security level of knowledge ofa position of the user equipment.

Also or alternatively, implementations of such a storage medium mayinclude one or more of the following features. The instructions compriseinstructions configured to cause the processor to determine adead-reckoning position of the user equipment, and wherein theinstructions are configured to cause the processor to determine whetherthe first SPS signal is anomalous in response to at least one of thefirst SPS signal measurement and the second SPS signal measurement beinginconsistent with the dead-reckoning position of the user equipment. Theinstructions comprise instructions configured to cause the processor torespond to determining that the first SPS signal is anomalous by atleast one of: disregarding the first SPS signal to determine a positionof the user equipment; or disregarding the first pseudorange based onthe first SPS signal to determine the position of the user equipment; orde-weighting the first SPS signal to determine the position of the userequipment; or de-weighting the first pseudorange based on the first SPSsignal to determine the position of the user equipment; or using the oneor more base station signal measurements to determine the position ofthe user equipment; or increasing one or more weightings of the one ormore base station signal measurements to determine the position of theuser equipment; or sending an anomaly indication, indicating that thefirst SPS signal is anomalous, to a first network entity; or sending aset of SPS signal measurements to a second network entity.

Another example user equipment comprising: an SPS receiver to receivesatellite positioning system signals; a communication transmitter; amemory; and a processor communicatively coupled to the memory, to theSPS receiver to receive SPS signals from the SPS receiver, and to thecommunication transmitter to convey communication signals wirelessly,the processor being configured to respond to a request for authorizationfor a financial transaction by conveying, via the communicationtransmitter to a network entity: a plurality of SPS measurementscorresponding to a plurality of SPS signals; identities of satellitevehicles corresponding to the plurality of SPS signals; a position ofthe user equipment based on a positioning technique other than an SPSpositioning technique; and a timestamp.

Implementations of such a user equipment may include one or more of thefollowing features. The processor is configured to encrypt the pluralityof SPS measurements. The plurality of SPS measurements comprisepseudoranges. The plurality of SPS measurements comprise rawmeasurements of the plurality of SPS signals.

An example method, at a user equipment, of processing positioningsignals including an alleged satellite positioning signal that isspoofed includes: measuring a plurality of positioning signals,including the alleged satellite positioning signal, to produce aplurality of positioning signal measurements including a firstpositioning signal measurement of the alleged satellite positioningsignal and a second positioning signal measurement of one of theplurality of positioning signals other than the alleged satellitepositioning signal; determining a difference between the firstpositioning signal measurement and the second positioning signalmeasurement; determining that the difference is greater than a thresholddifference; and determining a location of the user equipment using atleast one location-determining measurement of the plurality ofpositioning signal measurements while, in response to determining thatthe difference is greater than the threshold difference, excluding thefirst positioning signal measurement from the at least onelocation-determining measurement.

An example positioning method at a user equipment includes: measuring aplurality of location signals including at least one alleged satellitepositioning signal that is spoofed; determining a difference between atleast one measurement of the at least one alleged satellite positioningsignal and at least one expected satellite positioning signalmeasurement; determining that the difference is greater than a thresholddifference; and determining a location of the user equipment usingmeasurements of the plurality of location signals while excluding the atleast one measurement of the at least one alleged satellite positioningsignal.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a simplified diagram of an example wireless communications andsatellite signaling environment.

FIG. 2 is a block diagram of components of an example user equipmentshown in FIG. 1.

FIG. 3 is a block diagram of components of an exampletransmission/reception point shown in FIG. 1.

FIG. 4 is a block diagram of components of an example server shown inFIG. 1.

FIG. 5 is a block diagram of an example user equipment.

FIG. 6 is a simplified diagram of an environment in which a userequipment of FIG. 5 receives anomalous and non-anomalous signals.

FIG. 7 is a simplified diagram of a signal emulator shown in FIG. 6.

FIG. 8 is a signal and process flow for identifying an anomalous signal.

FIG. 9 is a block flow diagram of a method of determining location of auser equipment in the presence of one or more spoofed satellite signals.

FIG. 10 is a block flow diagram of a method of detecting an anomaloussignal.

FIG. 11 is a block flow diagram of a method of processing positioningsignals.

FIG. 12 is a block flow diagram of a positioning method.

DETAILED DESCRIPTION

Techniques are discussed herein for detecting anomalous signals such asspoofed satellite positioning system signals. For example, a mobiledevice may receive one or more anomalous signals. In variousembodiments, there may be a set of anomalous signals that overpower orreplace the existing SPS (Satellite Positioning System) or otherlocation-related signals to cause mobile devices and/or other devices tocalculate an incorrect location or to obfuscate or jam or otherwise makereliable location determination difficult. For example, anomaloussignals may be used to spoof or otherwise cause a false location to bedetermined. Location spoofing may be utilized to fool location-enabledpoint-of-sale protection or other security based around transactionsthat are limited to particular geographical scopes or requiringdifferent degrees of authentication depending on geography. Anomaloussignals and location spoofing could also be utilized to clog traffic orto cause traffic accidents or to direct autonomous vehicles to the wrongdestination or to foil asset-tracking attempts. Anomalous signals couldbe transmitted in a localized manner such as in a screened chamber or inan enclosed building, taking advantage of weaker indoor SPS signals, orin a more global sense, such as by a satellite constellation (e.g., ofanother country). No matter the purpose of the anomalous signal(s), themobile device (e.g., a vehicle) may be configured to detect anomaloussignals and to address the anomalous signal(s), for example, by ignoringthe anomalous signal(s) in favor of non-spoofed and/or more reliablelocation sources and/or to flag the anomalous signal(s) to otherdevices, for example via a location server or base-station based alertor by marking signal sources in assistance data as unreliable. Anomaloussignals may be SPS-related or may be terrestrial-based such as beingfrom fake base stations and/or access points. Whatever the signal sourceand/or the spoofed device, the mobile device may be configured to detectspoofed and/or otherwise anomalous signals and to calculate the locationof the mobile device while eliminating or reducing impact from theanomalous signal(s).

An anomalous signal may have a corresponding purported source, e.g., byhaving a format similar to (e.g., identical to) a format of signals sentby the purported source; however, the anomalous signal may have modifiedparameters such as time and/or date information, identification, encodedephemeris or other encoded information that would lead the mobile deviceto calculate the wrong location or fail to calculate a location. Forexample, a set of SPS signals may be emulated to cause the mobile deviceto calculate a location that is different than the actual location. Forexample, anomalous signals may simulate signals of a particular SPSconstellation at a particular frequency band such as GPS (GlobalPositioning System) signal(s) at L1 or may comprise simulated signalscorresponding to multiple SPS constellations and/or of multiplefrequency bands. The more complex the anomalous scenario becomes, themore technically difficult the scenario may be to create/emulate and themore expensive the anomalous scenario becomes to deploy. In anembodiment, the mobile device may compare a measurement of the receivedanomalous signal to a measurement of another received signal that isexpected to have comparable power, path delay, and/or other signalparameters. In an embodiment, a GPS L1 signal from a particularsatellite may be compared against what would be expected for acorresponding signal from the same satellite at a different band such asGPS L5 or GPS L2 or other frequency band relative to signal strength,signal delay, encoded information and other signal parameters. If thecorresponding signal from the other band is not present or differssignificantly in one or more details such as signal strength, timing,and/or encoded information, the signal may be anomalous. In anembodiment, a GPS signal from a first satellite may be compared againstother GPS signals from other satellites or SPS signals from otherconstellations such as GLONASS for consistency in predicted locationand/or signal strength, timing, or encoded messaging, comparingpredicted signal and messaging parameters against expected signal andmessaging parameters, given current ephemeris information for eachconstellation and approximate location of the mobile device. Similartechniques may be applied across other constellations such as GLONASS,Galileo, and BeiDou. In an embodiment, a least squares fit calculationmay be done or measurements inserted into a Kalman or other positioningfilter, where measurements that do not agree with the current estimatedlocation and/or that have significant variance from the othermeasurements inserted into the location calculation may be flagged assuspect. This is particularly true if signal parameters vary by morethan can be predicted by naturally-occurring signal multipath conditions(e.g., predict a location more than a few hundred meters away from thetrue location or are significantly stronger than signals from othersatellites and/or constellations), possibly also considering the currentenvironment and blockage conditions. For example, SPS multipath mayresult in determined location being off hundreds of meters but willtypically not result in a calculated location further away from truelocation than a few hundred meters, such as in another city or anothercountry, determined from other detected signals and/or from locationstate engines such as a location predicted by an ongoing Kalmanfiltering operation or recently stored determined location, possiblyaged for uncertainty growth based upon a reasonable estimated travelspeed or a maximum travel speed.

Received power of the received signal(s) may be compared with anexpected power for signals from the sources corresponding to thereceived signals. If the signal power is significantly different than apredicted or expected signal power, then the received signal(s) may beidentified as anomalous. In an embodiment, SPS signals may be comparedagainst other SPS signals received at the same time for consistency inreceived power, encoded messaging, ephemeris information, time, andother parameters and SPS signals that do not agree with either themajority of the received signals or that do not agree with locationhistory or do not agree with location filter output, especially thosethat would predict significantly different locations, may be flagged asanomalous. In an embodiment, a set of SPS signals may be identified thatare consistent with each other, perhaps received at a stronger signalpower, and the power, encoded data, and predicted location can becompared against prior or predicted location, againstlower-power-received SPS signals, either on the same band or on otherbands, for consistency and rejected if the SPS signals in the setdisagree with current or predicted location state by a significantdegree or if the SPS signals in the set do not agree with a plurality ofother SPS signals such as signals from other constellations and/or SPSsignals received at other frequencies. In some scenarios, a spoofingsource (regardless of technology, whether SPS, WAN, or WiFi) is likelyto be the strongest signal source present as the intent is to cause themobile device to disregard other signal sources based on typicalcriteria to use the strongest signal sources (which would normally meanthe sources with the least multipath, with the exception of spoofedsignals which take advantage of these criteria).

A satellite measurement may be compared against other measurements ofsignals from other satellites within a given constellation or multipleconstellations to determine whether all satellites are consistent withinreason with what would be predicted based on ephemeris information andtime. If, for example, measurements of signals from many (e.g., amajority of) the satellites yield one location and measurements of a fewsignals, albeit with stronger receive power, coalesce around a differentlocation (especially one far off from the first location), then the fewsignals may be identified as anomalous (e.g., potentially spoofed). Insuch a scenario, there may be two clusters of locations, one close to alocation based on historical data and/or other satellite systems whichmay be used to predict where the other satellites ought to be (or theirsignal strength, or Doppler, or time-of-flight/delay, or combinationthereof, ought to be) and another clustered around a bogus emulatedlocation.

In another embodiment, the mobile device may determine, based on knownalmanac and/or ephemeris information and time, a region of skycorresponding to the origin of the anomalous signal and determinewhether the purported source of the anomalous signal is consistent withwhat would be predicted based on ephemeris/almanac and time. In anembodiment, the mobile device, particularly in areas of significantblockage and/or multipath, may compare an SPS signal against other SPSsignals that are, based on ephemeris predictions and time, predicted tobe originating from satellites in the same region of the sky forconsistency in signal power and timing (with the assumption that thesesignals would experience the same multipath and attenuation).

As yet another example, a time-filtered location of the mobile devicemay be determined with a filter, such as a Kalman filter, that usesmultiple measurements over time. The mobile device may identify areceived signal as being anomalous if a pseudorange based on thereceived signal is inconsistent with the time-filtered location (e.g.,comes no closer than a threshold distance from the time-filteredlocation).

Still other example techniques may be used to identify anomaloussignals. In an embodiment, a group of strong signals, particularly ifthe strong signals are from the same SPS constellation and the sameband, may be used to determine a location which is then validatedagainst terrestrial location signals and/or Kalman filter output and/orrecently stored location (e.g., less than an hour) and, if there isinconsistency, weaker SPS signals stored in memory may be utilized todetermine the location while ignoring the stronger signals. Also oralternatively, a secondary SPS search could be conducted identifyingsecondary or lower-strength correlation peaks and comparing thepseudoranges predicted by these lower-strength peaks against otherconstellations and/or against terrestrial sources to attempt tocalculate a true SPS location while disregarding anomalous sources. Alsoor alternatively, phase delay times and/or Doppler of the signals may becompared to determine whether the higher-strength-peak signals may beanomalous (with signals outside expected time windows and/or Dopplerwindows being identified as anomalous). Also or alternatively, a coarselocation of a mobile device (e.g., based on WAN and/or WiFi signals) maybe used to determine expected Doppler and phase shift, and an SPS signalthat is significantly different from the expected Doppler and/or phaseshift may be identified as anomalous. In an embodiment, search windowsmay be set based on weaker SPS location sources or based on terrestrialsignal sources and time information, such that anomalous signal sourcesare ignored. In an embodiment, additional correlation peaks may bereported to and utilized by the location engine, including those furtheraway from strong detected correlation peaks, particularly if the weakerpeaks are in agreement with predicted or known location approximations.

A signal identified as anomalous may be re-checked to help determinewhether the signal is erroneous (e.g., spoofed or otherwise inaccurate).One or more techniques used to identify the signal as anomalous may berepeated, e.g., using different measurements or expectations forcomparison, and/or one or more other techniques may be used to determinewhether the signal is anomalous. If the re-checking does not determinethat the signal is anomalous, then the signal may be re-classified asnot anomalous and may, for example, be used for location determination.If the re-checking determines that the signal is anomalous, then thesignal may be identified as erroneous and appropriate action taken(e.g., disregarding the signal, notifying other entities of theerroneous nature of the signal, etc.).

These are examples, and other examples may be implemented.

Items and/or techniques described herein may provide one or more of thefollowing capabilities, as well as other capabilities not mentioned.Spoofed or otherwise inaccurate signals such as satellite positioningsignals may be identified. Use of inaccurate signals in determining alocation of a mobile device may be avoided or discounted. Determinationof an incorrect location based on one or more inaccurate signals may beavoided and actions based on such incorrect location may be prevented.Fraudulent assertions of location may be prevented. Fraudulent financialtransactions using location verification may be avoided. Othercapabilities may be provided and not every implementation according tothe disclosure must provide any, let alone all, of the capabilitiesdiscussed.

Referring to FIG. 1, an example wireless communications and satellitesignaling environment 100 includes a wireless communication system 110,mobile SPS-enabled devices 161, 162, 163, a satellite signal emulator170, and satellite constellations 180, 190. The wireless communicationsystem 110 includes a user equipment (UE) 112, a UE 113, a UE 114, a UE115, base transceiver stations (BTSs) 120, 121, 122, 123, a network 130,a core network 140, and an external client 150. The core network 140(e.g., a 5G core network (5GC)) may include back-end devices including,among other things, an Access and Mobility Management Function (AMF)141, a Session Management Function (SMF) 142, a server 143, and aGateway Mobile Location Center (GMLC) 144. The AMF 141, the SMF 142, theserver 143, and the GMLC 144 are communicatively coupled to each other.The server 143 may be, for example, a Location Management Function (LMF)that supports positioning of the UEs 112-114 (e.g., using techniquessuch as Assisted Global Navigation Satellite System (A-GNSS), OTDOA(Observed Time Difference of Arrival, e.g., Downlink (DL) OTDOA and/orUplink (UL) OTDOA), Round Trip Time (RTT), Multi-Cell RTT, RTK (RealTime Kinematic), PPP (Precise Point Positioning), DGNSS (DifferentialGNSS), E-CID (Enhanced Cell ID), AoA (Angle of Arrival), AoD (Angle ofDeparture), etc.). The communication system 110 may include additionalor alternative components. The satellite signal emulator 170 may beconfigured to provide erroneous, e.g., spoofed, SPS (SatellitePositioning System) signals that appear to be from a satellite, whichmay lead to erroneous location determination, e.g., by one or more ofthe devices 161-163 and/or one or more of the UEs 112-114. The devices161-163 and the UEs 112-114 may be configured to identify anomalous SPSsignals and take appropriate action, e.g., ignoring the anomaloussignals for determining location.

An LMF may also be referred to as a Location Manager (LM), a LocationFunction (LF), a commercial LMF (CLMF), or a value-added LMF (VLMF). Theserver 143 (e.g., an LMF) and/or one or more other devices of the system110 (e.g., one or more of the UEs 112-114) may be configured todetermine locations of the UEs 112-114. The server 143 may communicatedirectly with the BTS 121 (e.g., a gNB) and/or one or more other BTSs,and may be integrated with the BTS 121 and/or one or more other BTSs.The SMF 142 may serve as an initial contact point of a Service ControlFunction (SCF) (not shown) to create, control, and delete mediasessions. The server 143 (e.g., an LMF) may be co-located or integratedwith a gNB or a TRP (Transmission/Reception Point), or may be disposedremote from the gNB and/or TRP and configured to communicate directly orindirectly with the gNB and/or the TRP.

The AMF 141 may serve as a control node that processes signaling betweenthe UEs 112-114 and the core network 140, and may provide QoS (Qualityof Service) flow and session management. The AMF 141 may supportmobility of the UEs 112-114 including cell change and handover and mayparticipate in supporting signaling connection to the UEs 112-114.

The system 110 is capable of wireless communication in that componentsof the system 110 can communicate with one another (at least some timesusing wireless connections) directly or indirectly, e.g., via the BTSs120-123 and/or the network 130 (and/or one or more other devices notshown, such as one or more other base transceiver stations). Forindirect communications, the communications may be altered duringtransmission from one entity to another, e.g., to alter headerinformation of data packets, to change format, etc. The UEs 112-114shown are a smartphone, a tablet computer, and a vehicle-based device,but these are examples only as the UEs 112-114 are not required to beany of these configurations, and other configurations of UEs may beused. The UEs 112, 113 shown are mobile wireless communication devices(although they may communicate wirelessly and via wired connections)including mobile phones (including smartphones) and a tablet computer.The UE 114 shown is a vehicle-based mobile wireless communication device(although the UE 114 may communicate wirelessly and via wiredconnections). The UE 115 is shown as a generic UE and may be one or moretypes of UEs, whether mobile or not, whether of a type shown or not. Forexample, the UE 115 may include one or more UEs that are, or may beassociated with an entity that is, a typically-static or static devicesuch as a cash register, an automatic teller machine (ATM), a restaurantor other building, etc. Other types of UEs may include wearable devices(e.g., smart watches, smart jewelry, smart glasses or headsets, etc.).Still other UEs may be used, whether currently existing or developed inthe future. Further, other wireless devices (whether mobile or not) maybe implemented within the system 110 and may communicate with each otherand/or with the UEs 112-115, the BTSs 120-123, the network 130, the corenetwork 140, and/or the external client 150. For example, such otherdevices may include internet of thing (IoT) devices, medical devices,home entertainment and/or automation devices, etc. The core network 140may communicate with the external client 150 (e.g., a computer system),e.g., to allow the external client 150 to request and/or receivelocation information regarding the UEs 112-114 (e.g., via the GMLC 144).

The UEs 112-115 or other devices may be configured to communicate invarious networks and/or for various purposes and/or using varioustechnologies (e.g., 5G, Wi-Fi communication, multiple frequencies ofWi-Fi communication), satellite positioning, one or more types ofcommunications (e.g., GSM (Global System for Mobiles), CDMA (CodeDivision Multiple Access), LTE (Long-Term Evolution), V2X(Vehicle-to-everything e.g., V2P (Vehicle-to-Pedestrian), V2I(Vehicle-to-Infrastructure), V2V (Vehicle-to-Vehicle), etc.), IEEE802.11p, etc.). V2X communications may be cellular (Cellular-V2X(C-V2X)) and/or WiFi (e.g., DSRC (Dedicated Short-Range Connection)).The system 110 may support operation on multiple carriers (waveformsignals of different frequencies). Multi-carrier transmitters cantransmit modulated signals simultaneously on the multiple carriers. Eachmodulated signal may be a Code Division Multiple Access (CDMA) signal, aTime Division Multiple Access (TDMA) signal, an Orthogonal FrequencyDivision Multiple Access (OFDMA) signal, a Single-Carrier FrequencyDivision Multiple Access (SC-FDMA) signal, etc. Each modulated signalmay be sent on a different carrier and may carry pilot, overheadinformation, data, etc. The communication links shown in FIG. 1 areexamples and not limiting of the disclosure. The UEs 112-114 maycommunicate with base stations, with other UEs, etc.

The BTSs 120-123 may wirelessly communicate with the UEs 112-115 in thesystem 110 via one or more antennas. A BTS may also be referred to as abase station, an access point, a gNode B (gNB), an access node (AN), aNode B, an evolved Node B (eNB), etc. For example, each of the BTSs 120,121 may be a gNB or a transmission point gNB, the BTS 122 may be a macrocell (e.g., a high-power cellular base station) and/or a small cell(e.g., a low-power cellular base station), and the BTS 123 may be anaccess point (e.g., a short-range base station configured to communicatewith short-range technology such as WiFi, WiFi-Direct (WiFi-D),Bluetooth®, Bluetooth®-low energy (BLE), Zigbee, etc. One or more of theBTSs 120-123 may be configured to communicate with the UEs 112-115 viamultiple carriers. Each of the BTSs 120, 121 may provide communicationcoverage for a respective geographic region, e.g. a cell. Each cell maybe partitioned into multiple sectors as a function of the base stationantennas. A BTS may be any of a variety of forms such as a desktopdevice, a roadside unit (RSU), etc.

The BTSs 120-123 each comprise one or more Transmission/Reception Points(TRPs). For example, each sector within a cell of a BTS may comprise aTRP, although multiple TRPs may share one or more components (e.g.,share a processor but have separate antennas). The system 110 mayinclude only macro TRPs or the system 110 may have TRPs of differenttypes, e.g., macro, pico, and/or femto TRPs, etc. A macro TRP may covera relatively large geographic area (e.g., several kilometers in radius)and may allow unrestricted access by terminals with servicesubscription. A pico TRP may cover a relatively small geographic area(e.g., a pico cell) and may allow unrestricted access by terminals withservice subscription. A femto or home TRP may cover a relatively smallgeographic area (e.g., a femto cell) and may allow restricted access byterminals having association with the femto cell (e.g., terminals forusers in a home).

The UEs 112-115 may be referred to as terminals, access terminals (ATs),mobile stations, mobile devices, subscriber units, etc. The UEs 112-115may include various devices as listed above and/or other devices. TheUEs 112-115 may be configured to connect indirectly to one or morecommunication networks via one or more device-to-device (D2D)peer-to-peer (P2P) links. The D2D P2P links may be supported with anyappropriate D2D radio access technology (RAT), such as LTE Direct(LTE-D), WiFi Direct (WiFi-D), Bluetooth®, and so on. One or more of agroup of the UEs 112-115 utilizing D2D communications may be within ageographic coverage area of a TRP such as one or more of the BTSs120-123. Other UEs in such a group may be outside such geographiccoverage areas, or be otherwise unable to receive transmissions from abase station. Groups of the UEs 112-115 communicating via D2Dcommunications may utilize a one-to-many (1:M) system in which each UEmay transmit to other UEs in the group. A TRP of the BTSs 120-123 mayfacilitate scheduling of resources for D2D communications. In othercases, D2D communications may be carried out between UEs without theinvolvement of a TRP.

The mobile SPS-enabled devices 161-163 are configured with SPScapabilities (e.g., to determine location based on received SPSsignals). One or more of the SPS-enabled devices 161-163 may beconfigured with other capabilities, e.g., communication capabilities,similar to those of the UEs 112-115. The device 161 is an airplane andthe device 162 is an unoccupied aerial vehicle (UAV), but these areexamples only and not limiting of the disclosure. The mobile SPS-enableddevice 163 is shown as a generic SPS-enabled device. The device 163 maybe one or more mobile SPS-enabled devices such as one or more land-baseditems (e.g., a train, a truck, a tank, etc.), one or more water-baseditems (e.g., a ship, a jet-ski, etc.), and/or one or more air-baseditems (e.g., a missile, a space ship, etc.), etc. These examples arenon-limiting of the disclosure and other SPS-enabled devices may beused.

The communication system 110 may utilize information from aconstellation 180 of satellite vehicles (SVs) 181, 182, 183 and/or aconstellation 190 of SVs 191, 192, 193. Each of the constellations 180,190 may correspond to a respective Global Navigation Satellite System(GNSS) (i.e., Satellite Positioning System (SPS)) such as the GlobalPositioning System (GPS), the GLObal NAvigation Satellite System(GLONASS), Galileo, BeiDou, or some other local or regional SPS such asthe Indian Regional Navigational Satellite System (IRNSS), the EuropeanGeostationary Navigation Overlay Service (EGNOS), or the Wide AreaAugmentation System (WAAS). Only three SVs are shown for each of theconstellations 180, 190, but constellations of GNSS SVs will includemore than three SVs.

Referring also to FIG. 2, a UE 200 is an example of one of the UEs 105,106 and comprises a computing platform including a processor 210, memory211 including software (SW) 212, one or more sensors 213, a transceiverinterface 214 for a transceiver 215 (that includes a wirelesstransceiver 240 and/or a wired transceiver 250), a user interface 216, aSatellite Positioning System (SPS) receiver 217, a camera 218, and aposition device (PD) 219. The processor 210, the memory 211, thesensor(s) 213, the transceiver interface 214, the user interface 216,the SPS receiver 217, the camera 218, and the position device 219 may becommunicatively coupled to each other by a bus 220 (which may beconfigured, e.g., for optical and/or electrical communication). One ormore of the shown apparatus (e.g., the camera 218, the position device219, and/or one or more of the sensor(s) 213, etc.) may be omitted fromthe UE 200. The processor 210 may include one or more intelligenthardware devices, e.g., a central processing unit (CPU), amicrocontroller, an application specific integrated circuit (ASIC), etc.The processor 210 may comprise multiple processors including ageneral-purpose/application processor 230, a Digital Signal Processor(DSP) 231, a modem processor 232, a video processor 233, and/or a sensorprocessor 234. One or more of the processors 230-234 may comprisemultiple devices (e.g., multiple processors). For example, the sensorprocessor 234 may comprise, e.g., processors for RF (radio frequency)sensing (with one or more (cellular) wireless signals transmitted andreflection(s) used to identify, map, and/or track an object), and/orultrasound, etc. The modem processor 232 may support dual SIM/dualconnectivity (or even more SIMs). For example, a SIM (SubscriberIdentity Module or Subscriber Identification Module) may be used by anOriginal Equipment Manufacturer (OEM), and another SIM may be used by anend user of the UE 200 for connectivity. The memory 211 is anon-transitory storage medium that may include random access memory(RAM), flash memory, disc memory, and/or read-only memory (ROM), etc.The memory 211 stores the software 212 which may be processor-readable,processor-executable software code containing instructions that areconfigured to, when executed, cause the processor 210 to perform variousfunctions described herein. Alternatively, the software 212 may not bedirectly executable by the processor 210 but may be configured to causethe processor 210, e.g., when compiled and executed, to perform thefunctions. The description may refer only to the processor 210performing a function, but this includes other implementations such aswhere the processor 210 executes software and/or firmware. Thedescription may refer to the processor 210 performing a function asshorthand for one or more of the processors 230-234 performing thefunction. The description may refer to the UE 200 performing a functionas shorthand for one or more appropriate components of the UE 200performing the function. The processor 210 may include a memory withstored instructions in addition to and/or instead of the memory 211.Functionality of the processor 210 is discussed more fully below.

The configuration of the UE 200 shown in FIG. 2 is an example and notlimiting of the disclosure, including the claims, and otherconfigurations may be used. For example, an example configuration of theUE includes one or more of the processors 230-234 of the processor 210,the memory 211, and the wireless transceiver 240. Other exampleconfigurations include one or more of the processors 230-234 of theprocessor 210, the memory 211, the wireless transceiver 240, and one ormore of the sensor(s) 213, the user interface 216, the SPS receiver 217,the camera 218, the PD 219, and/or the wired transceiver 250.

The UE 200 may comprise the modem processor 232 that may be capable ofperforming baseband processing of signals received and down-converted bythe transceiver 215 and/or the SPS receiver 217. The modem processor 232may perform baseband processing of signals to be upconverted fortransmission by the transceiver 215. Also or alternatively, basebandprocessing may be performed by the processor 230 and/or the DSP 231.Other configurations, however, may be used to perform basebandprocessing.

The UE 200 may include the sensor(s) 213 that may include, for example,one or more of various types of sensors such as one or more inertialsensors, one or more magnetometers, one or more environment sensors, oneor more optical sensors, one or more weight sensors, one or more radiofrequency (RF) sensors, one or more ranging sensors, and/or one or moreaudio sensors (e.g., microphones), etc. An inertial measurement unit(IMU) may comprise, for example, one or more accelerometers (e.g.,collectively responding to acceleration of the UE 200 in threedimensions) and/or one or more gyroscopes (e.g., three-dimensionalgyroscope(s)). The sensor(s) 213 may include one or more magnetometers(e.g., three-dimensional magnetometer(s)) to determine orientation(e.g., relative to magnetic north and/or true north) that may be usedfor any of a variety of purposes, e.g., to support one or more compassapplications. The environment sensor(s) may comprise, for example, oneor more temperature sensors, one or more barometric pressure sensors,one or more ambient light sensors, one or more camera imagers, and/orone or more microphones, etc. The sensor(s) 213 may generate analogand/or digital signals indications of which may be stored in the memory211 and processed by the DSP 231 and/or the processor 230 in support ofone or more applications such as, for example, applications directed topositioning and/or navigation operations. Ranging sensors may includeRADAR (radio detection and ranging), LIDAR (light detection andranging), and/or SONAR (sound navigation and ranging) systems (e.g.,each including one or more appropriate transducers such as antennas,optical transducers, and/or one or more speakers and/or microphones).

The sensor(s) 213 may be used in relative location measurements,relative location determination, motion determination, etc. Informationdetected by the sensor(s) 213 may be used for motion detection, relativedisplacement, dead reckoning, sensor-based location determination,and/or sensor-assisted location determination. The sensor(s) 213 may beuseful to determine whether the UE 200 is fixed (stationary) or mobileand/or whether to report certain useful information to the LMF 143regarding the mobility of the UE 200. For example, based on theinformation obtained/measured by the sensor(s) 213, the UE 200 maynotify/report to the LMF 143 that the UE 200 has detected movements orthat the UE 200 has moved, and report the relative displacement/distance(e.g., via dead reckoning, or sensor-based location determination, orsensor-assisted location determination enabled by the sensor(s) 213). Inanother example, for relative positioning information, the sensors/IMUcan be used to determine the angle and/or orientation of the otherdevice with respect to the UE 200, etc.

The IMU may be configured to provide measurements about a direction ofmotion and/or a speed of motion of the UE 200, which may be used inrelative location determination. For example, one or more accelerometersand/or one or more gyroscopes of the IMU may detect, respectively, alinear acceleration and a speed of rotation of the UE 200. The linearacceleration and speed of rotation measurements of the UE 200 may beintegrated over time to determine an instantaneous direction of motionas well as a displacement of the UE 200. The instantaneous direction ofmotion and the displacement may be integrated to track a location of theUE 200. For example, a reference location of the UE 200 may bedetermined, e.g., using the SPS receiver 217 (and/or by some othermeans) for a moment in time and measurements from the accelerometer(s)and gyroscope(s) taken after this moment in time may be used in deadreckoning to determine present location of the UE 200 based on movement(direction and distance) of the UE 200 relative to the referencelocation.

The magnetometer(s) may determine magnetic field strengths in differentdirections which may be used to determine orientation of the UE 200. Forexample, the orientation may be used to provide a digital compass forthe UE 200. The magnetometer(s) may include a two-dimensionalmagnetometer configured to detect and provide indications of magneticfield strength in two orthogonal dimensions. The magnetometer(s) mayinclude a three-dimensional magnetometer configured to detect andprovide indications of magnetic field strength in three orthogonaldimensions. The magnetometer(s) may provide means for sensing a magneticfield and providing indications of the magnetic field, e.g., to theprocessor 210.

The transceiver 215 may include a wireless transceiver 240 and a wiredtransceiver 250 configured to communicate with other devices throughwireless connections and wired connections, respectively. For example,the wireless transceiver 240 may include a wireless transmitter 242 anda wireless receiver 244 coupled to one or more antennas 246 fortransmitting (e.g., on one or more uplink channels and/or one or moresidelink channels) and/or receiving (e.g., on one or more downlinkchannels and/or one or more sidelink channels) wireless signals 248 andtransducing signals from the wireless signals 248 to wired (e.g.,electrical and/or optical) signals and from wired (e.g., electricaland/or optical) signals to the wireless signals 248. Thus, the wirelesstransmitter 242 may include multiple transmitters that may be discretecomponents or combined/integrated components, and/or the wirelessreceiver 244 may include multiple receivers that may be discretecomponents or combined/integrated components. The wireless transceiver240 may be configured to communicate signals (e.g., with TRPs and/or oneor more other devices) according to a variety of radio accesstechnologies (RATs) such as 5G New Radio (NR), GSM (Global System forMobiles), UMTS (Universal Mobile Telecommunications System), AMPS(Advanced Mobile Phone System), CDMA (Code Division Multiple Access),WCDMA (Wideband CDMA), LTE (Long-Term Evolution), LTE Direct (LTE-D),3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11p), WiFi, WiFiDirect (WiFi-D), Bluetooth®, Zigbee etc. New Radio may use mm-wavefrequencies and/or sub-6 GHz frequencies. The wired transceiver 250 mayinclude a wired transmitter 252 and a wired receiver 254 configured forwired communication, e.g., a network interface that may be utilized tocommunicate with the network 130 to send communications to, and receivecommunications from, the network 130. The wired transmitter 252 mayinclude multiple transmitters that may be discrete components orcombined/integrated components, and/or the wired receiver 254 mayinclude multiple receivers that may be discrete components orcombined/integrated components. The wired transceiver 250 may beconfigured, e.g., for optical communication and/or electricalcommunication. The transceiver 215 may be communicatively coupled to thetransceiver interface 214, e.g., by optical and/or electricalconnection. The transceiver interface 214 may be at least partiallyintegrated with the transceiver 215.

The user interface 216 may comprise one or more of several devices suchas, for example, a speaker, microphone, display device, vibrationdevice, keyboard, touch screen, etc. The user interface 216 may includemore than one of any of these devices. The user interface 216 may beconfigured to enable a user to interact with one or more applicationshosted by the UE 200. For example, the user interface 216 may storeindications of analog and/or digital signals in the memory 211 to beprocessed by DSP 231 and/or the general-purpose processor 230 inresponse to action from a user. Similarly, applications hosted on the UE200 may store indications of analog and/or digital signals in the memory211 to present an output signal to a user. The user interface 216 mayinclude an audio input/output (I/O) device comprising, for example, aspeaker, a microphone, digital-to-analog circuitry, analog-to-digitalcircuitry, an amplifier and/or gain control circuitry (including morethan one of any of these devices). Other configurations of an audio I/Odevice may be used. Also or alternatively, the user interface 216 maycomprise one or more touch sensors responsive to touching and/orpressure, e.g., on a keyboard and/or touch screen of the user interface216.

The SPS receiver 217 (e.g., a Global Positioning System (GPS) receiver)may be capable of receiving and acquiring SPS signals 260 via an SPSantenna 262. The antenna 262 is configured to transduce the wireless SPSsignals 260 to wired signals, e.g., electrical or optical signals, andmay be integrated with the antenna 246. The SPS receiver 217 may beconfigured to process, in whole or in part, the acquired SPS signals 260for estimating a location of the UE 200. For example, the SPS receiver217 may be configured to determine location of the UE 200 bytrilateration using the SPS signals 260. The general-purpose processor230, the memory 211, the DSP 231 and/or one or more specializedprocessors (not shown) may be utilized to process acquired SPS signals,in whole or in part, and/or to calculate an estimated location of the UE200, in conjunction with the SPS receiver 217. The memory 211 may storeindications (e.g., measurements) of the SPS signals 260 and/or othersignals (e.g., signals acquired from the wireless transceiver 240) foruse in performing positioning operations. The general-purpose processor230, the DSP 231, and/or one or more specialized processors, and/or thememory 211 may provide or support a location engine for use inprocessing measurements to estimate a location of the UE 200.

The UE 200 may include the camera 218 for capturing still or movingimagery. The camera 218 may comprise, for example, an imaging sensor(e.g., a charge coupled device or a CMOS imager), a lens,analog-to-digital circuitry, frame buffers, etc. Additional processing,conditioning, encoding, and/or compression of signals representingcaptured images may be performed by the general-purpose processor 230and/or the DSP 231. Also or alternatively, the video processor 233 mayperform conditioning, encoding, compression, and/or manipulation ofsignals representing captured images. The video processor 233 maydecode/decompress stored image data for presentation on a display device(not shown), e.g., of the user interface 216.

The position device (PD) 219 may be configured to determine a positionof the UE 200, motion of the UE 200, and/or relative position of the UE200, and/or time. For example, the PD 219 may communicate with, and/orinclude some or all of, the SPS receiver 217. The PD 219 may work inconjunction with the processor 210 and the memory 211 as appropriate toperform at least a portion of one or more positioning methods, althoughthe description herein may refer only to the PD 219 being configured toperform, or performing, in accordance with the positioning method(s).The PD 219 may also or alternatively be configured to determine locationof the UE 200 using terrestrial-based signals (e.g., at least some ofthe signals 248) for trilateration, for assistance with obtaining andusing the SPS signals 260, or both. The PD 219 may be configured to useone or more other techniques (e.g., relying on the UE's self-reportedlocation (e.g., part of the UE's position beacon)) for determining thelocation of the UE 200, and may use a combination of techniques (e.g.,SPS and terrestrial positioning signals) to determine the location ofthe UE 200. The PD 219 may include one or more of the sensors 213 (e.g.,gyroscope(s), accelerometer(s), magnetometer(s), etc.) that may senseorientation and/or motion of the UE 200 and provide indications thereofthat the processor 210 (e.g., the processor 230 and/or the DSP 231) maybe configured to use to determine motion (e.g., a velocity vector and/oran acceleration vector) of the UE 200. The PD 219 may be configured toprovide indications of uncertainty and/or error in the determinedposition and/or motion. Functionality of the PD 219 may be provided in avariety of manners and/or configurations, e.g., by the generalpurpose/application processor 230, the transceiver 215, the SPS receiver217, and/or another component of the UE 200, and may be provided byhardware, software, firmware, or various combinations thereof.

Referring also to FIG. 3, an example of a TRP 300 of the base stations120-123 comprises a computing platform including a processor 310, memory311 including software (SW) 312, and a transceiver 315. The processor310, the memory 311, and the transceiver 315 may be communicativelycoupled to each other by a bus 320 (which may be configured, e.g., foroptical and/or electrical communication). One or more of the shownapparatus (e.g., a wireless interface) may be omitted from the TRP 300.The processor 310 may include one or more intelligent hardware devices,e.g., a central processing unit (CPU), a microcontroller, an applicationspecific integrated circuit (ASIC), etc. The processor 310 may comprisemultiple processors (e.g., including a general-purpose/applicationprocessor, a DSP, a modem processor, a video processor, and/or a sensorprocessor as shown in FIG. 2). The memory 311 is a non-transitorystorage medium that may include random access memory (RAM)), flashmemory, disc memory, and/or read-only memory (ROM), etc. The memory 311stores the software 312 which may be processor-readable,processor-executable software code containing instructions that areconfigured to, when executed, cause the processor 310 to perform variousfunctions described herein. Alternatively, the software 312 may not bedirectly executable by the processor 310 but may be configured to causethe processor 310, e.g., when compiled and executed, to perform thefunctions. The description may refer only to the processor 310performing a function, but this includes other implementations such aswhere the processor 310 executes software and/or firmware. Thedescription may refer to the processor 310 performing a function asshorthand for one or more of the processors contained in the processor310 performing the function. The description may refer to the TRP 300performing a function as shorthand for one or more appropriatecomponents of the TRP 300 (and thus of one of the base stations 120-123)performing the function. The processor 310 may include a memory withstored instructions in addition to and/or instead of the memory 311.Functionality of the processor 310 is discussed more fully below.

The transceiver 315 may include a wireless transceiver 340 and/or awired transceiver 350 configured to communicate with other devicesthrough wireless connections and wired connections, respectively. Forexample, the wireless transceiver 340 may include a wireless transmitter342 and a wireless receiver 344 coupled to one or more antennas 346 fortransmitting (e.g., on one or more uplink channels and/or one or moredownlink channels) and/or receiving (e.g., on one or more downlinkchannels and/or one or more uplink channels) wireless signals 348 andtransducing signals from the wireless signals 348 to wired (e.g.,electrical and/or optical) signals and from wired (e.g., electricaland/or optical) signals to the wireless signals 348. Thus, the wirelesstransmitter 342 may include multiple transmitters that may be discretecomponents or combined/integrated components, and/or the wirelessreceiver 344 may include multiple receivers that may be discretecomponents or combined/integrated components. The wireless transceiver340 may be configured to communicate signals (e.g., with the UE 200, oneor more other UEs, and/or one or more other devices) according to avariety of radio access technologies (RATs) such as 5G New Radio (NR),GSM (Global System for Mobiles), UMTS (Universal MobileTelecommunications System), AMPS (Advanced Mobile Phone System), CDMA(Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long-TermEvolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11(including IEEE 802.11p), WiFi, WiFi Direct (WiFi-D), Bluetooth®, Zigbeeetc. The wired transceiver 350 may include a wired transmitter 352 and awired receiver 354 configured for wired communication, e.g., a networkinterface that may be utilized to communicate with the network 130 tosend communications to, and receive communications from, the LMF 120,for example, and/or one or more other network entities. The wiredtransmitter 352 may include multiple transmitters that may be discretecomponents or combined/integrated components, and/or the wired receiver354 may include multiple receivers that may be discrete components orcombined/integrated components. The wired transceiver 350 may beconfigured, e.g., for optical communication and/or electricalcommunication.

The configuration of the TRP 300 shown in FIG. 3 is an example and notlimiting of the disclosure, including the claims, and otherconfigurations may be used. For example, the description hereindiscusses that the TRP 300 is configured to perform or performs severalfunctions, but one or more of these functions may be performed by theLMF 143 and/or the UE 200 (i.e., the LMF 143 and/or the UE 200 may beconfigured to perform one or more of these functions).

Referring also to FIG. 4, a server 400, which is an example of the LMF143, comprises a computing platform including a processor 410, memory411 including software (SW) 412, and a transceiver 415. The processor410, the memory 411, and the transceiver 415 may be communicativelycoupled to each other by a bus 420 (which may be configured, e.g., foroptical and/or electrical communication). One or more of the shownapparatus (e.g., a wireless interface) may be omitted from the server400. The processor 410 may include one or more intelligent hardwaredevices, e.g., a central processing unit (CPU), a microcontroller, anapplication specific integrated circuit (ASIC), etc. The processor 410may comprise multiple processors (e.g., including ageneral-purpose/application processor, a DSP, a modem processor, a videoprocessor, and/or a sensor processor as shown in FIG. 2). The memory 411is a non-transitory storage medium that may include random access memory(RAM)), flash memory, disc memory, and/or read-only memory (ROM), etc.The memory 411 stores the software 412 which may be processor-readable,processor-executable software code containing instructions that areconfigured to, when executed, cause the processor 410 to perform variousfunctions described herein. Alternatively, the software 412 may not bedirectly executable by the processor 410 but may be configured to causethe processor 410, e.g., when compiled and executed, to perform thefunctions. The description may refer only to the processor 410performing a function, but this includes other implementations such aswhere the processor 410 executes software and/or firmware. Thedescription may refer to the processor 410 performing a function asshorthand for one or more of the processors contained in the processor410 performing the function. The description may refer to the server 400performing a function as shorthand for one or more appropriatecomponents of the server 400 performing the function. The processor 410may include a memory with stored instructions in addition to and/orinstead of the memory 411. Functionality of the processor 410 isdiscussed more fully below.

The transceiver 415 may include a wireless transceiver 440 and/or awired transceiver 450 configured to communicate with other devicesthrough wireless connections and wired connections, respectively. Forexample, the wireless transceiver 440 may include a wireless transmitter442 and a wireless receiver 444 coupled to one or more antennas 446 fortransmitting (e.g., on one or more downlink channels) and/or receiving(e.g., on one or more uplink channels) wireless signals 448 andtransducing signals from the wireless signals 448 to wired (e.g.,electrical and/or optical) signals and from wired (e.g., electricaland/or optical) signals to the wireless signals 448. Thus, the wirelesstransmitter 442 may include multiple transmitters that may be discretecomponents or combined/integrated components, and/or the wirelessreceiver 444 may include multiple receivers that may be discretecomponents or combined/integrated components. The wireless transceiver440 may be configured to communicate signals (e.g., with the UE 200, oneor more other UEs, and/or one or more other devices) according to avariety of radio access technologies (RATs) such as 5G New Radio (NR),GSM (Global System for Mobiles), UMTS (Universal MobileTelecommunications System), AMPS (Advanced Mobile Phone System), CDMA(Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long-TermEvolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11(including IEEE 802.11p), WiFi, WiFi Direct (WiFi-D), Bluetooth®, Zigbeeetc. The wired transceiver 450 may include a wired transmitter 452 and awired receiver 454 configured for wired communication, e.g., a networkinterface that may be utilized to communicate with the network 130 tosend communications to, and receive communications from, the TRP 300,for example, and/or one or more other entities. The wired transmitter452 may include multiple transmitters that may be discrete components orcombined/integrated components, and/or the wired receiver 454 mayinclude multiple receivers that may be discrete components orcombined/integrated components. The wired transceiver 450 may beconfigured, e.g., for optical communication and/or electricalcommunication.

The description herein may refer only to the processor 410 performing afunction, but this includes other implementations such as where theprocessor 410 executes software (stored in the memory 411) and/orfirmware. The description herein may refer to the server 400 performinga function as shorthand for one or more appropriate components (e.g.,the processor 410 and the memory 411) of the server 400 performing thefunction.

Positioning Techniques

For terrestrial positioning of a UE in cellular networks, techniquessuch as Advanced Forward Link Trilateration (AFLT) and Observed TimeDifference Of Arrival (OTDOA) often operate in “UE-assisted” mode inwhich measurements of reference signals (e.g., PRS, CRS, etc.)transmitted by base stations are taken by the UE and then provided to alocation server. The location server then calculates the position of theUE based on the measurements and known locations of the base stations.Because these techniques use the location server to calculate theposition of the UE, rather than the UE itself, these positioningtechniques are not frequently used in applications such as car orcell-phone navigation, which instead typically rely on satellite-basedpositioning.

A UE may use a Satellite Positioning System (SPS) (a Global NavigationSatellite System (GNSS)) for high-accuracy positioning using precisepoint positioning (PPP) or real time kinematic (RTK) technology. Thesetechnologies use assistance data such as measurements from ground-basedstations. LTE Release 15 allows the data to be encrypted so that onlythe UEs subscribed to the service can read the information. Suchassistance data varies with time. Thus, a UE subscribed to the servicemay not easily “break encryption” for other UEs by passing on the datato other UEs that have not paid for the subscription. The passing onwould need to be repeated every time the assistance data changes.

In UE-assisted positioning, the UE sends measurements (e.g., TDOA, Angleof Arrival (AoA), etc.) to the positioning server (e.g., LMF/eSMLC). Thepositioning server has the base station almanac (BSA) that containsmultiple ‘entries’ or ‘records’, one record per cell, where each recordcontains geographical cell location but also may include other data. Anidentifier of the ‘record’ among the multiple ‘records’ in the BSA maybe referenced. The BSA and the measurements from the UE may be used tocompute the position of the UE.

In conventional UE-based positioning, a UE computes its own position,thus avoiding sending measurements to the network (e.g., locationserver), which in turn improves latency and scalability. The UE usesrelevant BSA record information (e.g., locations of gNBs (more broadlybase stations)) from the network. The BSA information may be encrypted.But since the BSA information varies much less often than, for example,the PPP or RTK assistance data described earlier, it may be easier tomake the BSA information (compared to the PPP or RTK information)available to UEs that did not subscribe and pay for decryption keys.Transmissions of reference signals by the gNBs make BSA informationpotentially accessible to crowd-sourcing or war-driving, essentiallyenabling BSA information to be generated based on in-the-field and/orover-the-top observations.

Positioning techniques may be characterized and/or assessed based on oneor more criteria such as position determination accuracy and/or latency.Latency is a time elapsed between an event that triggers determinationof position-related data and the availability of that data at apositioning system interface, e.g., an interface of the LMF 143. Atinitialization of a positioning system, the latency for the availabilityof position-related data is called time to first fix (TTFF), and islarger than latencies after the TTFF. An inverse of a time elapsedbetween two consecutive position-related data availabilities is calledan update rate, i.e., the rate at which position-related data aregenerated after the first fix. Latency may depend on processingcapability, e.g., of the UE. For example, a UE may report a processingcapability of the UE as a duration of DL PRS symbols in units of time(e.g., milliseconds) that the UE can process every T amount of time(e.g., T ms) assuming 272 PRB (Physical Resource Block) allocation.Other examples of capabilities that may affect latency are a number ofTRPs from which the UE can process PRS, a number of PRS that the UE canprocess, and a bandwidth of the UE.

One or more of many different positioning techniques (also calledpositioning methods) may be used to determine position of an entity suchas one of the UEs 105, 106. For example, known position-determinationtechniques include RTT, multi-RTT, OTDOA (also called TDOA and includingUL-TDOA and DL-TDOA), Enhanced Cell Identification (E-CID), DL-AoD,UL-AoA, etc. RTT uses a time for a signal to travel from one entity toanother and back to determine a range between the two entities. Therange, plus a known location of a first one of the entities and an anglebetween the two entities (e.g., an azimuth angle) can be used todetermine a location of the second of the entities. In multi-RTT (alsocalled multi-cell RTT), multiple ranges from one entity (e.g., a UE) toother entities (e.g., TRPs) and known locations of the other entitiesmay be used to determine the location of the one entity. In TDOAtechniques, the difference in travel times between one entity and otherentities may be used to determine relative ranges from the otherentities and those, combined with known locations of the other entitiesmay be used to determine the location of the one entity. Angles ofarrival and/or departure may be used to help determine location of anentity. For example, an angle of arrival or an angle of departure of asignal combined with a range between devices (determined using signal,e.g., a travel time of the signal, a received power of the signal, etc.)and a known location of one of the devices may be used to determine alocation of the other device. The angle of arrival or departure may bean azimuth angle relative to a reference direction such as true north.The angle of arrival or departure may be a zenith angle relative todirectly upward from an entity (i.e., relative to radially outward froma center of Earth). E-CID uses the identity of a serving cell, thetiming advance (i.e., the difference between receive and transmit timesat the UE), estimated timing and power of detected neighbor cellsignals, and possibly angle of arrival (e.g., of a signal at the UE fromthe base station or vice versa) to determine location of the UE. InTDOA, the difference in arrival times at a receiving device of signalsfrom different sources along with known locations of the sources andknown offset of transmission times from the sources are used todetermine the location of the receiving device.

In a network-centric RTT estimation, the serving base station instructsthe UE to scan for/receive RTT measurement signals (e.g., PRS) onserving cells of two or more neighboring base stations (and typicallythe serving base station, as at least three base stations are needed).The one of more base stations transmit RTT measurement signals on lowreuse resources (e.g., resources used by the base station to transmitsystem information) allocated by the network (e.g., a location serversuch as the LMF 143). The UE records the arrival time (also referred toas a receive time, a reception time, a time of reception, or a time ofarrival (ToA)) of each RTT measurement signal relative to the UE'scurrent downlink timing (e.g., as derived by the UE from a DL signalreceived from its serving base station), and transmits a common orindividual RTT response message (e.g., SRS (sounding reference signal)for positioning, i.e., UL-PRS) to the one or more base stations (e.g.,when instructed by its serving base station) and may include the timedifference T_(Rx→Tx) (i.e., UE T_(Rx-Tx) or UE_(Rx-Tx)) between the ToAof the RTT measurement signal and the transmission time of the RTTresponse message in a payload of each RTT response message. The RTTresponse message would include a reference signal from which the basestation can deduce the ToA of the RTT response. By comparing thedifference T_(Rx→Tx) between the transmission time of the RTTmeasurement signal from the base station and the ToA of the RTT responseat the base station to the UE-reported time difference T_(Rx→Tx), thebase station can deduce the propagation time between the base stationand the UE, from which the base station can determine the distancebetween the UE and the base station by assuming the speed of lightduring this propagation time.

A UE-centric RTT estimation is similar to the network-based method,except that the UE transmits uplink RTT measurement signal(s) (e.g.,when instructed by a serving base station), which are received bymultiple base stations in the neighborhood of the UE. Each involved basestation responds with a downlink RTT response message, which may includethe time difference between the ToA of the RTT measurement signal at thebase station and the transmission time of the RTT response message fromthe base station in the RTT response message payload.

For both network-centric and UE-centric procedures, the side (network orUE) that performs the RTT calculation typically (though not always)transmits the first message(s) or signal(s) (e.g., RTT measurementsignal(s)), while the other side responds with one or more RTT responsemessage(s) or signal(s) that may include the difference between the ToAof the first message(s) or signal(s) and the transmission time of theRTT response message(s) or signal(s).

A multi-RTT technique may be used to determine position. For example, afirst entity (e.g., a UE) may send out one or more signals (e.g.,unicast, multicast, or broadcast from the base station) and multiplesecond entities (e.g., other TSPs such as base station(s) and/or UE(s))may receive a signal from the first entity and respond to this receivedsignal. The first entity receives the responses from the multiple secondentities. The first entity (or another entity such as an LMF) may usethe responses from the second entities to determine ranges to the secondentities and may use the multiple ranges and known locations of thesecond entities to determine the location of the first entity bytrilateration.

In some instances, additional information may be obtained in the form ofan angle of arrival (AoA) or angle of departure (AoD) that defines astraight-line direction (e.g., which may be in a horizontal plane or inthree dimensions) or possibly a range of directions (e.g., for the UEfrom the locations of base stations). The intersection of two directionscan provide another estimate of the location for the UE.

For positioning techniques using PRS (Positioning Reference Signal)signals (e.g., TDOA and RTT), PRS signals sent by multiple TRPs aremeasured and the arrival times of the signals, known transmission times,and known locations of the TRPs used to determine ranges from a UE tothe TRPs. For example, an RSTD (Reference Signal Time Difference) may bedetermined for PRS signals received from multiple TRPs and used in aTDOA technique to determine position (location) of the UE. A positioningreference signal may be referred to as a PRS or a PRS signal. The PRSsignals are typically sent using the same power and PRS signals with thesame signal characteristics (e.g., same frequency shift) may interferewith each other such that a PRS signal from a more distant TRP may beoverwhelmed by a PRS signal from a closer TRP such that the signal fromthe more distant TRP may not be detected. PRS muting may be used to helpreduce interference by muting some PRS signals (reducing the power ofthe PRS signal, e.g., to zero and thus not transmitting the PRS signal).In this way, a weaker (at the UE) PRS signal may be more easily detectedby the UE without a stronger PRS signal interfering with the weaker PRSsignal. The term RS, and variations thereof (e.g., PRS, SRS), may referto one reference signal or more than one reference signal.

Positioning reference signals (PRS) include downlink PRS (DL PRS, oftenreferred to simply as PRS) and uplink PRS (UL PRS) (which may be calledSRS (Sounding Reference Signal) for positioning). A PRS may comprise aPN code (pseudorandom number code) or be generated using a PN code(e.g., scrambling a PN code with another signal) such that a source ofthe PRS may serve as a pseudo-satellite (a pseudolite). The PN code maybe unique to the PRS source (at least within a specified area such thatidentical PRS from different PRS sources do not overlap). PRS maycomprise PRS resources or PRS resource sets of a frequency layer. A DLPRS positioning frequency layer (or simply a frequency layer) is acollection of DL PRS resource sets, from one or more TRPs, with PRSresource(s) that have common parameters configured by higher-layerparameters DL-PRS-PositioningFrequencyLayer, DL-PRS-ResourceSet, andDL-PRS-Resource. Each frequency layer has a DL PRS subcarrier spacing(SCS) for the DL PRS resource sets and the DL PRS resources in thefrequency layer. Each frequency layer has a DL PRS cyclic prefix (CP)for the DL PRS resource sets and the DL PRS resources in the frequencylayer. In 5G, a resource block occupies 12 consecutive subcarriers and aspecified number of symbols. Also, a DL PRS Point A parameter defines afrequency of a reference resource block (and the lowest subcarrier ofthe resource block), with DL PRS resources belonging to the same DL PRSresource set having the same Point A and all DL PRS resource setsbelonging to the same frequency layer having the same Point A. Afrequency layer also has the same DL PRS bandwidth, the same start PRB(and center frequency), and the same value of comb size (i.e., afrequency of PRS resource elements per symbol such that for comb-N,every N^(th) resource element is a PRS resource element). A PRS resourceset is identified by a PRS resource set ID and may be associated with aparticular TRP (identified by a cell ID) transmitted by an antenna panelof a base station. A PRS resource ID in a PRS resource set may beassociated with an omnidirectional signal, and/or with a single beam(and/or beam ID) transmitted from a single base station (where a basestation may transmit one or more beams). Each PRS resource of a PRSresource set may be transmitted on a different beam and as such, a PRSresource (or simply resource), can also be referred to as a beam. Thisdoes not have any implications on whether the base stations and thebeams on which PRS are transmitted are known to the UE.

A TRP may be configured, e.g., by instructions received from a serverand/or by software in the TRP, to send DL PRS per a schedule. Accordingto the schedule, the TRP may send the DL PRS intermittently, e.g.,periodically at a consistent interval from an initial transmission. TheTRP may be configured to send one or more PRS resource sets. A resourceset is a collection of PRS resources across one TRP, with the resourceshaving the same periodicity, a common muting pattern configuration (ifany), and the same repetition factor across slots. Each of the PRSresource sets comprises multiple PRS resources, with each PRS resourcecomprising multiple Resource Elements (REs) that may be in multipleResource Blocks (RBs) within N (one or more) consecutive symbol(s)within a slot. An RB is a collection of REs spanning a quantity of oneor more consecutive symbols in the time domain and a quantity (12 for a5G RB) of consecutive subcarriers in the frequency domain. Each PRSresource is configured with an RE offset, slot offset, a symbol offsetwithin a slot, and a number of consecutive symbols that the PRS resourcemay occupy within a slot. The RE offset defines the starting RE offsetof the first symbol within a DL PRS resource in frequency. The relativeRE offsets of the remaining symbols within a DL PRS resource are definedbased on the initial offset. The slot offset is the starting slot of theDL PRS resource with respect to a corresponding resource set slotoffset. The symbol offset determines the starting symbol of the DL PRSresource within the starting slot. Transmitted REs may repeat acrossslots, with each transmission being called a repetition such that theremay be multiple repetitions in a PRS resource. The DL PRS resources in aDL PRS resource set are associated with the same TRP and each DL PRSresource has a DL PRS resource ID. A DL PRS resource ID in a DL PRSresource set is associated with a single beam transmitted from a singleTRP (although a TRP may transmit one or more beams).

A PRS resource may also be defined by quasi-co-location and start PRBparameters. A quasi-co-location (QCL) parameter may define anyquasi-co-location information of the DL PRS resource with otherreference signals. The DL PRS may be configured to be QCL type D with aDL PRS or SS/PBCH (Synchronization Signal/Physical Broadcast Channel)Block from a serving cell or a non-serving cell. The DL PRS may beconfigured to be QCL type C with an SS/PBCH Block from a serving cell ora non-serving cell. The start PRB parameter defines the starting PRBindex of the DL PRS resource with respect to reference Point A. Thestarting PRB index has a granularity of one PRB and may have a minimumvalue of 0 and a maximum value of 2176 PRBs.

A PRS resource set is a collection of PRS resources with the sameperiodicity, same muting pattern configuration (if any), and the samerepetition factor across slots. Every time all repetitions of all PRSresources of the PRS resource set are configured to be transmitted isreferred as an “instance”. Therefore, an “instance” of a PRS resourceset is a specified number of repetitions for each PRS resource and aspecified number of PRS resources within the PRS resource set such thatonce the specified number of repetitions are transmitted for each of thespecified number of PRS resources, the instance is complete. An instancemay also be referred to as an “occasion.” A DL PRS configurationincluding a DL PRS transmission schedule may be provided to a UE tofacilitate (or even enable) the UE to measure the DL PRS.

Multiple frequency layers of PRS may be aggregated to provide aneffective bandwidth that is larger than any of the bandwidths of thelayers individually. Multiple frequency layers of component carriers(which may be consecutive and/or separate) and meeting criteria such asbeing quasi co-located (QCLed), and having the same antenna port, may bestitched to provide a larger effective PRS bandwidth (for DL PRS and ULPRS) resulting in increased time of arrival measurement accuracy. BeingQCLed, the different frequency layers behave similarly, enablingstitching of the PRS to yield the larger effective bandwidth. The largereffective bandwidth, which may be referred to as the bandwidth of anaggregated PRS or the frequency bandwidth of an aggregated PRS, providesfor better time-domain resolution (e.g., of TDOA). An aggregated PRSincludes a collection of PRS resources and each PRS resource of anaggregated PRS may be called a PRS component, and each PRS component maybe transmitted on different component carriers, bands, or frequencylayers, or on different portions of the same band.

RTT positioning is an active positioning technique in that RTT usespositioning signals sent by TRPs to UEs and by UEs (that areparticipating in RTT positioning) to TRPs. The TRPs may send DL-PRSsignals that are received by the UEs and the UEs may send SRS (SoundingReference Signal) signals that are received by multiple TRPs. A soundingreference signal may be referred to as an SRS or an SRS signal. In 5Gmulti-RTT, coordinated positioning may be used with the UE sending asingle UL-SRS for positioning that is received by multiple TRPs insteadof sending a separate UL-SRS for positioning for each TRP. A TRP thatparticipates in multi-RTT will typically search for UEs that arecurrently camped on that TRP (served UEs, with the TRP being a servingTRP) and also UEs that are camped on neighboring TRPs (neighbor UEs).Neighbor TRPs may be TRPs of a single BTS (e.g., gNB), or may be a TRPof one BTS and a TRP of a separate BTS. For RTT positioning, includingmulti-RTT positioning, the DL-PRS signal and the UL-SRS for positioningsignal in a PRS/SRS for positioning signal pair used to determine RTT(and thus used to determine range between the UE and the TRP) may occurclose in time to each other such that errors due to UE motion and/or UEclock drift and/or TRP clock drift are within acceptable limits. Forexample, signals in a PRS/SRS for positioning signal pair may betransmitted from the TRP and the UE, respectively, within about 10 ms ofeach other. With SRS for positioning signals being sent by UEs, and withPRS and SRS for positioning signals being conveyed close in time to eachother, it has been found that radio-frequency (RF) signal congestion mayresult (which may cause excessive noise, etc.) especially if many UEsattempt positioning concurrently and/or that computational congestionmay result at the TRPs that are trying to measure many UEs concurrently.

RTT positioning may be UE-based or UE-assisted. In UE-based RTT, the UE200 determines the RTT and corresponding range to each of the TRPs 300and the position of the UE 200 based on the ranges to the TRPs 300 andknown locations of the TRPs 300. In UE-assisted RTT, the UE 200 measurespositioning signals and provides measurement information to the TRP 300,and the TRP 300 determines the RTT and range. The TRP 300 providesranges to a location server, e.g., the server 400, and the serverdetermines the location of the UE 200, e.g., based on ranges todifferent TRPs 300. The RTT and/or range may be determined by the TRP300 that received the signal(s) from the UE 200, by this TRP 300 incombination with one or more other devices, e.g., one or more other TRPs300 and/or the server 400, or by one or more devices other than the TRP300 that received the signal(s) from the UE 200.

Various positioning techniques are supported in 5G NR. The NR nativepositioning methods supported in 5G NR include DL-only positioningmethods, UL-only positioning methods, and DL+UL positioning methods.Downlink-based positioning methods include DL-TDOA and DL-AoD.Uplink-based positioning methods include UL-TDOA and UL-AoA. CombinedDL+UL-based positioning methods include RTT with one base station andRTT with multiple base stations (multi-RTT).

A UE and a server, e.g., an LMF, may engage in upper-layer messageexchange (handshaking) to exchange UE capabilities, assistance data formeasuring reference signals, and providing position information (e.g.,reference signal measurement(s), range(s), position estimate(s), etc.).For example, an LMF may request capabilities of the UE, e.g., forsupport for E-CID, multi-RTT, DL-AoD, DL-TDOA, and/or UL positioningtechniques. The UE may respond to the request by providing thecapability(ies) of the UE regarding one or more of the positioningtechniques. As another example, the UE may send a request for assistancedata to the LMF, e.g., for use by the UE to facilitate measurementand/or other processing of one or more reference signals for one or morepositioning techniques such as multi-RTT, DL-AoD, and/or DL-TDOA. TheLMF may respond to the request by providing assistance data tofacilitate the measurement and/or processing of one or more referencesignals for one or more of the positioning techniques. As anotherexample, the LMF may request position information from the UE, e.g.,regarding E-CID, multi-RTT, DL-AoD, and/or DL-TDOA positioningtechniques. The UE may respond by providing position information for oneor more of the positioning techniques requested.

OTDOA-based positioning performance depend on the bandwidth (e.g.,maximum bandwidth) of the UE and carrier frequency. Accuracy using OTDOAis affected by a time bandwidth product and thus the bandwidth of the UEaffects the resolution providable by the UE for OTDOA. The bandwidth ofthe UE may vary from UE to UE, but is typically fixed for each UE andmay be reported by the UE to an LMF, although each UE may have differentbandwidths for different radio technologies (e.g., WiFi vs. LTE vs. NRvs. Bluetooth®, etc.). Further, different carrier frequencies may havedifferent line of sight (LOS) paths due to different propagation of thedifferent carrier frequencies. For example, FR2 (24.25 GHz-52.6 GHz)typically has better and/or more LOS paths, but higher loss than FR1(410 MHz-7.125 GHz).

Angle of departure/angle of arrival (AoD/AoA) based positioningperformance may depend on carrier frequency more so than bandwidth.Propagation may be more affected by carrier frequency than bandwidth,and thus AoD/AoA-based positioning performance may be more dependent oncarrier frequency. AoD/AoA-based positioning may be more suitable forindoor positioning of a UE than for outdoor positioning of a UE, e.g.,due to stricter outdoor requirements.

SPS Spoofing Detection and Mitigation

Knowing the location of a UE is important for many applications and/orin many circumstances. Consequently, determining an incorrect locationof a UE may have significant consequences. An incorrect location may bedetermined based on erroneous input information such as an incorrect SPSsignal, whether the inaccuracy of the SPS signal is unintentional (e.g.,due to SV error) or intentional (e.g., due to an entity providing one ormore spoofed signals). A spoofed signal is a signal that appears to befrom a particular source (e.g., a known, trusted source) but is from adifferent source. For example, a spoofed signal may have characteristicsof a signal from a GPS SV but originate from a GLONASS SV or an SPSsimulator (e.g., a terrestrial-based SPS signal generator). Identifyinganomalous signals (i.e., signals that are unexpected and that may bespoofed or otherwise inaccurate) may help a UE mitigate the consequencesof receiving such signals, e.g., with the UE ignoring or discountingsuch signals in a determination of a location of the UE.

Referring to FIG. 5, with further reference to FIGS. 1-4, a UE 500includes a processor 510, an SPS receiver 515, an interface 520, and amemory 530 communicatively coupled to each other by a bus 540. The UE500 may include the components shown in FIG. 5, and may include one ormore other components such as any of those shown in FIG. 2 such that theUE 200 may be an example of the UE 500. The interface 520 may includeone or more components of the transceiver 215 or one or more portionsthereof (e.g., the antenna 246 and the wireless transmitter 242, thewireless receiver 244 and the antenna 246, or the wireless transmitter242, the wireless receiver 244, and the antenna 246). Also oralternatively, the interface 520 may include the wired transmitter 252and/or the wired receiver 254. The SPS receiver 515 may include the SPSreceiver 217 and the antenna 262. The memory 530 may be configuredsimilarly to the memory 211, e.g., including software withprocessor-readable instructions configured to cause the processor 510 toperform functions.

The description herein may refer only to the processor 510 performing afunction, but this includes other implementations such as where theprocessor 510 executes software (stored in the memory 530) and/orfirmware. The description herein may refer to the UE 500 performing afunction as shorthand for one or more appropriate components (e.g., theprocessor 510 and the memory 530) of the UE 500 performing the function.The processor 510 (possibly in conjunction with the memory 530 and, asappropriate, the SPS receiver 515 (and possibly the interface 520))includes an anomaly detection unit 550 configured to identify anomalousSPS signals that may be inaccurate, e.g., spoofed. The processor(possibly in conjunction with the memory 530) may include a locationdetermination unit 560 and/or an anomaly reporting unit 570. Theprocessor 510 may be configured to respond to a determination that asignal is anomalous by taking appropriate mitigation action, e.g.,discarding the signal, discarding a measurement of the signal,discounting the signal and/or a measurement of the signal as part ofdetermining a location of the UE 500, etc. The configuration andoperation of the anomaly detection unit 550 is discussed further below,e.g., with respect to FIGS. 8 and 9, after discussion of FIG. 6 thatprovides examples of scenarios of anomalous SPS signals.

The location determination unit 560 is configured to determine alocation of the UE 500 in one or more ways. The location determinationunit 560 may be configured to determine an approximate location or amore precise location. For example, the location determination unit 560may be configured to use a location of another entity, e.g., a TRP 300(e.g., a serving base station) or another UE, that is withincommunication range of the UE 500 as an approximate location of the UE500. As another example, the location determination unit 560 may beconfigured to implement one or more of the positioning techniquesdiscussed above to calculate a precise location of the UE 500. Thelocation determination unit 560 may be configured to determine atime-filtered location of the UE 500 by using a filter, e.g., a Kalmanfilter, to calculate location using measurements over time. The locationdetermination unit 560 may be configured to provide other locationfiltering and/or location prediction using previous locations stored inthe memory 530. The location determination unit 560 may be configured tomap information (e.g., locations of roads, railways, waterways, etc.) aspart of a location determination, e.g., to select a location within arange of locations that is consistent with the type of the UE 500 (e.g.,to select a road as a location for a car when a range of locationsincludes a pond). The unit 560 may be configured to disregard (e.g., notuse) an anomalous SPS signal and/or an SPS signal measurement based onan anomalous SPS signal in determining the location of the UE 500. Theunit 560 may be configured to use, but to de-weight, an SPS signalmeasurement of an SPS signal identified as anomalous to determine alocation of the UE 500. For example, the unit 560 may reduce a weightingof (e.g., apply a weighting factor less than 1 to) the SPS signalmeasurement or may weight the SPS signal measurement less than other SPSsignal measurements when the measurement is used in a positioningtechnique (e.g., an algorithm) for determining the location of the UE500.

The anomaly reporting unit 570 is configured to report one or moreindications of an anomalous SPS signal (or signals). The unit 570 mayreport the anomaly(ies) to a user of the UE 500 (e.g., through the userinterface 216) and/or to another entity such as a network entity (e.g.,the TRP 300 and/or the server 400). The report may be an alarm such asan audible alert and/or a visual alert via the user interface 216.

Referring also to FIG. 6, in an example environment 600, the UE 500 mayreceive one or more anomalous SPS signals due to various scenarios. Forexample, the SV 183 may send an anomalous SPS signal 680 to the UE 500.The anomalous SPS signal 680 may be anomalous in one or more ways. Forexample, the signal 680 may be a spoofed signal, being produced with aformat associated with the SV 183 but being inaccurate, e.g., havingincorrect timing, which may lead to an inaccurate determination of therange from the UE 500 to the SV 183. As another example, the signal 680may be a spoofed signal, having a format associated with another SV,e.g., another SV of the same constellation that contains the SV 183(i.e., the constellation 180) or another SV of a differentconstellation, e.g., of the constellation 190. In this case, apseudorange determined for the signal 680 may correspond to the rangefrom the UE 500 to the SV 183 but the UE 500 will use this range as arange from the UE 500 to the expected location (e.g., as indicated byephemeris data) of the SV 191. In either of these scenarios, i.e.,inaccurate information in a signal of a format of the SV 183 orsimulating a format of another SV, the UE 500 may calculate an incorrectlocation for the UE 500 if the UE 500 does not recognize the signal 680as being anomalous and thus does not take appropriate action, e.g., notuse the signal 680 and/or a pseudorange determined from the signal 680to determine the location of the UE 500. The anomalous SPS signal 680has a carrier frequency, and the carrier frequency may be a frequencyoften used by UEs to determine location using SPS signals, such as an L1frequency (1575.42 MHz) of a GPS system. The SV 183 may also send one ormore non-anomalous SPS signals such a non-anomalous SPS signal 683,especially if the anomalous SPS signal 680 was sent due to anoperational error of the SV 183. The non-anomalous SPS signal 683 mayhave a different carrier frequency than the anomalous SPS signal 680.

As another example of the UE 500 receiving an anomalous SPS signal, theUE 500 may receive one or more anomalous SPS signals 615, 625 fromsignal emulators 610, 620, respectively.

The signal emulators 610, 620 may be SPS signal simulators configured toproduce and send signals that mimic SPS signals and/or may be configuredto simulate one or more non-satellite signals, e.g., WiFi signals, WANsignals, Bluetooth® signals, etc. The anomalous SPS signals 615, 625 maythus emulate signals from (e.g., have formats (e.g., pseudorandom codes)corresponding to) SVs such as the SVs 191, 192, respectively, and/or oneor more other signal sources (e.g., terrestrial base stations). Theanomalous SPS signals 615, 625 may have much higher power thannon-anomalous signals, e.g., SPS signals 691, 692 from the SVs 191, 192,when received by the UE 500, which may cause the UE 500 to lock to theanomalous SPS signals 615, 625 over (instead of) the non-anomaloussignals, e.g., the SPS signals 691, 692 actually sent by the SVs 191,192. The discussion herein may assume that signals to be determined asanomalous/non-anomalous are SPS signals, but the discussion isapplicable to non-SPS signals.

As discussed further below, the UE 500 may use one or more otherentities in the environment 600 to help identify anomalous signals asbeing anomalous, e.g., by determining consistency or inconsistency ofthe anomalous signal with other information. For example, the UE 500 maybe configured to determine a distance to the UE 114 using signaling 630(e.g., radar signals, sonar signals, and/or lidar signals). The UE 500may, for example, use this distance information and a location of the UE114 provided by the UE 114 to the UE 500 to help determine consistencyof one or more SPS signals with an approximate location of the UE 500.The UE 500 may be configured to use visual information (e.g., light rays642 reflected off a landmark 640) to determine the approximate locationof the UE 500. The UE 500 may, for example, capture one or more imagesof the landmark 640 using the camera 218, identify the landmark 640,find a location of the landmark 640 in a lookup table of landmarks andlocations (or by inquiring another entity, such as the server 400, forthis information), and use the location of the landmark 640 as anapproximate location of the UE 500. The UE 500 may also consider one ormore other factors such as an orientation of the UE 500, a zoom factorused in capturing an image of the landmark 640, and a size of thelandmark in the image, to determine a location of the UE 500 (e.g.,based on a location of the UE 500 relative to the landmark 640).

Referring to FIG. 7, with further reference to FIGS. 1-6, a signalemulator 700 includes a processor 710, an interface 720, and a memory730 communicatively coupled to each other by a bus 740. The emulator 700may include some or all of the components shown in FIG. 7, and mayinclude one or more other components such as any of those shown in FIG.3. The processor 710 may include one or more components of the processor310. The interface 720 may include one or more of the components of thetransceiver 315, e.g., the wireless transmitter 342 and the antenna 346,or the wireless receiver 344 and the antenna 346, or the wirelesstransmitter 342, the wireless receiver 344, and the antenna 346. Thememory 730 may be configured similarly to the memory 311, e.g.,including software with processor-readable instructions configured tocause the processor 710 to perform functions.

The description herein may refer only to the processor 710 performing afunction, but this includes other implementations such as where theprocessor 710 executes software (stored in the memory 730) and/orfirmware. The description herein may refer to the emulator 700performing a function as shorthand for one or more appropriatecomponents (e.g., the processor 710 and the memory 730) of the emulator700 performing the function. The processor 710 (possibly in conjunctionwith the memory 730 and, as appropriate, the interface 720) includes anemulation unit 750. The emulation unit 750 may comprise software (e.g.,part of the memory 730) to be executed by a processor, and/or firmware,and/or hardware. The configuration and functionality of the emulationunit 750 is discussed further herein.

The emulation unit 750 may be configured to simulate signals, e.g., fromsatellites and/or terrestrial-based sources. The emulation unit 750 maybe configured to emulate one or more satellite signals (e.g., from oneor more satellite constellations, e.g., GPS, GLONASS, BeiDou) and/or oneor more non-satellite signals (e.g., WiFi signal(s), WWAN signal(s),Bluetooth® signal(s), etc.), sending the one or more emulated satellitesignals via the interface 720 (e.g., one or more appropriate wirelesstransmitters and/or one or more antennas). The emulation unit 750 may beconfigured to simulate signals from stationary and/or moving locations.For example, the emulation unit 750 may emulate signals from satellitesthat move with respect to the Earth over time. As another example, theemulation unit 750 may simulate a location that moves around ageographic area, e.g., in a circle. Such simulation may confuse a UEsuch that the UE cannot tell which signal(s) to trust, even if the UEcan tell that at least one signal being received should not be trusted,e.g., is a spoof signal.

Referring also to FIG. 8, a signaling and process flow 800 is shown forthe UE 500 receiving one or more anomalous SPS signals and identifyingthe anomalous SPS signals as anomalous. The flow 800 includes the stagesshown but is an example only, as stages may be added, rearranged, and/orremoved. For example, one or more stages or portions of stages of amethod 900 shown in FIG. 9 and discussed herein may be included in theflow 800. Also, a limited quantity of SPS signals are shown in order tofacilitate understanding, but numerous other signals may be received bythe UE 500, some of which are discussed.

At stage 810, the UE 500 receives anomalous SPS signals 680, 625 fromthe SV 183 and the signal emulator 620, respectively. The anomalous SPSsignal 680 may, for example, have a format that corresponds to the SV183 but may be in inaccurate in some way (e.g., timing, power, etc.). Asanother example, the signal 680 may have a format of another SV, i.e.,an SV other than the source of the signal 680, in this example, the SV183. The anomalous SPS signal 625 may have the format of an SPS signalcorresponding to an SV, in this example, the SV 191. For example, theemulation unit 750 of one or more of the signal emulators 700 producesand sends one or more emulated satellite signals, including theanomalous SPS signal 625, via the interface 720 to the UE 500. Theemulated signal may have a much higher signal strength, at least at theUE 500, than a satellite signal from a satellite being spoofed by theanomalous SPS signal 625. Anomalous signals spoofing non-SV signals maybe received by the UE 500 from the signal emulator 620 (a spoofed-signalsource), but the discussion of FIG. 7 uses the example of spoofed SVsignals.

At stage 820, the UE 500 may perform a sky aperture test to determinewhether a received signal is expected to be received and/or whether areceived signal originated from an expected region of the sky. Forexample, the anomaly detection unit 550 may be configured to use anestimate of the location of the UE 500 to determine which SVs should bevisible and/or which SVs should not be visible to the UE 500. Theestimate of the location of the UE 500 may be determined using one ormore of various techniques such as dead reckoning based on apreviously-determined location, or using a known location of a servingbase station as the estimated location, or another technique. The unit550 may be configured to determine expected visibility based onephemeris data (indicative of current and future SV locations) for oneor more constellations of SVs and an approximate location of the UE 500.The approximate location of the UE 500 may be based, e.g., on a receivedbase station signal and known location of the base station sending thesignal, a previously-determined location of the UE 500 and time sincethe determination of that location, etc. The anomaly detection unit 550may be configured to identify a signal as anomalous if the signalcorresponds to an SV that should not be visible at the presentapproximate location of the UE 500. Also or alternatively, the anomalydetection unit 550 may be configured to determine an approximatedirection (possibly corresponding to a region of the sky) from which areceived signal was sent. For example, the unit 550 may use sensorinformation from one or more of the sensor(s) 213 regarding orientationof the UE 500 and an angle of arrival, relative to the UE 500, of areceived signal to determine a region relative to a location of the UE500 from which the received signal originated, i.e., a source region.The source region may be a range of angles relative to a location of theUE 500, e.g., multiple combinations of θ and ϕ in spherical coordinates.The source region may, for example, be a source direction determinedfrom the angle of arrival and orientation of the UE 500, and anuncertainty around the source direction, e.g., such that the sourceregion includes the source direction and any direction within athreshold angle (e.g., 5°) of the source direction. The unit 550 may beconfigured to determine whether the source region corresponds to(includes) an expected location of an SV (e.g., based on ephemeris data)corresponding to the received signal (e.g., an SV that sends signalswith a same format as a format of the received signal). The unit 550 maybe configured to identify the received signal as an anomalous SPS signalif the signal did not originate from the expected location of the SV,e.g., if the expected location is not in the determined source region.For the exaggerated example shown in FIG. 6, the unit 550 may determinethat for the anomalous signal 615, the source region (which wouldinclude the signal emulator 610) does not include the SV 191, and thusthe unit 550 may label the anomalous signal 615 as anomalous.

The sky aperture test performed at stage 820 may help reduce successfulspoofing, particularly for some types of UEs. For example, for a vehicleUE (i.e., a UE in or part of a vehicle), the region of sky correspondingto a spoofed signal may change rapidly, much more rapidly than theregion of sky for an actual satellite signal. The UE may thus identity asignal as a spoofed signal based on the corresponding region of skychanging faster than a threshold rate. To combat this, numerous signalemulators could be placed over a large area to attempt to simulatesignals from the same satellite. As another example, a spoofed signalmay come from a terrestrial-based entity and a sky aperture testperformed by an aerial UE may identify a signal source as not being fromthe sky at all, but from the ground and thus may identify acorresponding “satellite” signal from this source as a spoofed signal.

At stage 830, non-anomalous signals are sent, e.g., the non-anomalousSPS signals 682, 683, 691, 692 sent by the SVs 182, 183, 191, 192, andreceived by the UE 500. The timing of the SPS signals shown areexamples, and SPS signals may be received at times in addition orinstead of the times shown. For example, the non-anomalous SPS signal691 may be sent by the SV 191 and received by the UE 500 before theanomalous SPS signal 615 is sent by the signal emulator 620 and receivedby the UE 500. The non-anomalous SPS signal 683 may, for example, have adifferent carrier frequency than the anomalous SPS signal 680. Thenon-anomalous SPS signal 691 may, for example, have the same carrierfrequency as the anomalous SPS signal 615. The non-anomalous SPS signals682, 692 may, for example, have the same carrier frequencies as thenon-anomalous SPS signals 683, 691, respectively.

At stage 840, the UE 500 may perform dead reckoning positiondetermination. For example, the processor 510 may use one or more motionsensor measurements to determine an amount (and possibly direction) ofmovement of the UE 500 since the time of the previously-determinedposition. The processor 510 may be configured to use the determinedmovement of the UE 500 and one or more previous SPS signal measurements(e.g., one or more raw measurements, such as time of arrival, and/or oneor more processed measurements, such as pseudorange) to determine one ormore expected present SPS signal measurements. For example, processor510 may be configured to use the determined movement (e.g., magnitudeand direction) and a previously-determined location of the UE 500 todetermine an approximate present location of the UE 500. The processor510 may be configured to use the approximate present location of the UE500 and a time since the previously-determined location was determinedto determine the expected present SPS signal measurement. The processor510 may be configured to trigger a consistency check in response to theexpected present SPS signal measurement differing from a correspondingactual present SPS signal measurement by more than a threshold amount.The threshold may take a variety of forms (e.g., a percentage, aquantity in units of the measurement (e.g., power)) and may have avariety of values.

At stage 850, the UE 500 may check SPS signal consistency to determinewhether an SPS signal is anomalous. The anomaly detection unit 550 maybe configured to determine whether there are one or more inconsistenciesregarding one or more signals, e.g., SPS signals, received by the UE 500relative to one or more expectations. An SPS signal inconsistency may bean unexpected signal measurement determined, for example, relative toone or more other SPS signals from the same SV and/or relative to one ormore other SPS signals from one or more other SVs (from the sameconstellation and/or one or more other constellations), and/or based ona determined location approximation for the UE 500. For example, theanomaly detection unit 550 may be configured to determine whether aninconsistency exists between SPS signals of different bands (carrierfrequencies in different bands) and/or between SPS signals of differentSVs (intra-constellation and/or inter-constellation). Other examples arepossible for determining SPS signal inconsistency.

The anomaly detection unit 550 may be configured to determine whether anSPS signal has a received power that is inconsistent with one or moreexpectations. For example, the unit 550 may be configured to detect thatthe received power differs from another received signal power bysignificantly more than an expected amount. The anomaly detection unit550 may be configured to determine an actual power difference betweenreceived signals and a corresponding expected power difference anddetermine whether the actual power difference differs from the expectedpower difference by more than a power threshold, or is higher than amaximum expected power (e.g., for any SPS signal). The analyzed SPSsignals may correspond to the same SV and may have the same or differentcarrier frequencies, or the analyzed SPS signals may correspond todifferent SVs (within the same constellation or in differentconstellations). For example, the anomaly detection unit 550 maydetermine an actual power difference between the anomalous SPS signal615 (from the signal emulator 620) and the non-anomalous SPS signal 691(from the SV 191) in response to the anomalous signal 615 having aformat corresponding to (similar to or identical to) the format ofsignals sent by the SV 191, thus giving the appearance that theanomalous signal 615 originated from the SV 191. The anomaly detectionunit 550 may be able to differentiate the anomalous SPS signal 615 fromthe non-anomalous SPS signal 691 based on the signals 615, 691 being indifferent search windows (i.e., different combinations of time andfrequency (with the frequency possibly varying due to Doppler shift ofthe same carrier frequency)). For example, the anomaly detection unit550 may determine that signals from one or more other constellations(e.g., GLONASS, BeiDou) have expected received powers, and thus usethese signals and/or terrestrial positioning (e.g., using WiFi and/orWAN positioning techniques) to determine an estimated location of the UE500. Knowing the estimated location and time, the anomaly detection unit550 may determine the search windows (in time and frequency) for thenon-anomalous signals 691, 692, etc. (e.g., of the GPS constellation).The anomaly detection unit 550 may use these search windows to measurethe non-anomalous signals 691, 692, and not measure the anomaloussignals 615, 625 (or at least to differentiate between the signals 615,625 and the signals 691, 692, e.g., in response to which the UE 500 mayde-weight measurements of the anomalous signals 615, 625 relative to thenon-anomalous signals 691, 692). This may be particularly effective whenthe UE 500 is outdoors, and thus will typically have multipleconstellations visible. The anomaly detection unit 550 may also oralternatively determine an expected power difference for multiple SPSsignals received from the SV 191. For example, for multiple SPS signalswith the same carrier frequency both received from the SV 191 within athreshold amount of time of each other, the anomaly detection unit 550may determine (e.g., retrieve from the memory 530) an expected powerdifference that is very small. The anomaly detection unit 550 maydetermine whether the actual power difference between the signals 615,691 differs by more than a power threshold from the expected powerdifference. For example, the expected power difference for signals fromthe same SV within a small time window may be zero (or nearly zero), andthe power threshold may be small, e.g., 1 dB. Because the anomaloussignal 615 came from the signal emulator 620, the power of the signal615 may be much higher than the power of the signal 691, and thus thedifference in power between the signals 615, 691 may be much higher than1 dB. The anomaly detection unit 550 may respond to the actualdifference being more than a threshold amount (e.g., 5%, 10%, 20%, orother amount) greater than the expected difference by identifying thesignal 615 as anomalous (and/or identify the signal 691 as anomalous).Comparing signals over time that are supposedly from the same SV andhave the same carrier frequency may help detect introduction of aspoofed SPS signal.

As another example, the anomaly detection unit 550 may determine actualand expected power differences for the signals 615, 691, where thesignals 615, 691 have different carrier frequencies. In this case, theexpected power difference may be small (e.g., zero or close to zero) andthe power threshold may be small, e.g., 1 dB. Comparing signals from thesame SV but with different carrier frequencies may help identify spoofedsignals as signals may only be spoofed for an SV (or a constellation)for one carrier frequency (or at least less than all carrierfrequencies).

As another example, the anomaly detection unit 550 may determine actualand expected power differences between the anomalous SPS signal 615 andanother SPS signal of another SV, e.g., one of the SPS signals 682, 683,692. The anomaly detection unit 550 may determine the expected powerdifference based on ephemeris data for the appropriate SV 182, 183, 192and an approximate location of the UE 500. The power threshold maydepend on the expected power difference, or may be independent of thepower difference, e.g., being a percentage or an amount of decibels.Comparing signals from different SVs may help identify spoofed signalsas signals might only be spoofed for one constellation (or at least lessthan all constellations). For example, if the UE 500 is indoors, all SPSsignals will typically be received with very low power if at all, butspoofed SPS signals may be received with much higher power than theactual SPS signals, and with adequate power for location determination.The SVs may be selected based on their visibility to the UE 500 and/ortheir relative position in the sky. For example, the anomaly detectionunit 550 may select SPS signals for SVs that are close enough to eachother that the attenuation and/or multi-path effects for the SPS signalsfrom the SVs are likely to be similar, e.g., such that the expectedpower difference will be near zero.

Received power inconsistency over time and/or between SVs (e.g., betweenconstellations) may be particularly helpful in identifying indoor SPSsignal spoofing. For example, if the anomaly detection unit 550determines that an SPS signal from an SV in one constellation, e.g., theSV 181 in the constellation 180, decreases in power (e.g., due to the UE500 moving from being outdoor to indoor) but that the received powerfrom an SPS signal purportedly from another SV of another constellation,e.g., the SV 191 of the constellation 190, increases or at least doesnot decrease similarly to the power decrease of the SPS signal from theSV 181, then the anomaly detection unit 550 may identify the SPS signalfrom the SV 191 as anomalous. The anomaly detection unit 550 may beconfigured to analyze the SPS signals from multiple SVs of multipleconstellations such that the anomaly detection unit 550 may identify SPSsignals of one constellation as anomalous where the received power ofthese SPS signals do not decrease in power nearly as much as (or evenincrease in power relative to) the received power of multiple SPSsignals from another constellation. As another example, the anomalydetection unit 550 may determine that an SPS is a spoofed SPS signal ifthe signal has a received power above a threshold, e.g., a thresholdhigher than an expected power of any non-spoofed SPS signal.

The anomaly detection unit 550 may be configured to determine whether anSPS signal has a corresponding pseudorange that is inconsistent withexpectation. For example, the anomaly detection unit 550 may beconfigured to determine that a pseudorange to an SV based on atime-filtered location determination differs by more than a pseudorangethreshold relative to a pseudorange determined using an SPS signalpurportedly from that SV. The anomaly detection unit 550 may use afilter result (e.g., a Kalman filter result) for a location of the UE500 to determine an expected pseudorange to an expected location of anSV based on ephemeris data. The anomaly detection unit 550 may determinea measured pseudorange to the SV based on a measured SPS signalcorresponding to the SV (e.g., having a format of signals from the SV).The anomaly detection unit may identify the measured SPS signal asanomalous if the expected pseudorange differs from the measuredpseudorange by more than the pseudorange threshold, e.g., by more than1%, or 5%, or 10% of the measured pseudorange (or of the expectedpseudorange). This may help identify a signal from an SV of oneconstellation that emulates a signal from another constellation asanomalous. As another example, the anomaly detection unit 550 may beconfigured to determine that a pseudorange based on received (actual orspoofed) SPS signals purportedly from the same SV deviates from anexpectation by more than a pseudorange threshold. For example, theanomaly detection unit 550 may identify a change in pseudorange of morethan 1% or more than 5% or more than 10% between pseudorangedeterminations to indicate that the SPS signal corresponding to thelater pseudorange determination is anomalous. The value of thepseudorange threshold may be a function of the time between reception ofthe SPS signals corresponding to the pseudoranges being compared (e.g.,with the pseudorange threshold having a higher value (e.g., a higherpercentage) the longer the time between signal reception leading to thepseudoranges being compared). As another example, the anomaly detectionunit 550 may be configured to determine whether a pseudorange differencebased on measured SPS signals differs by more than a threshold amountfrom an expected amount. Similar to the discussion above with respect topower differences, the anomaly detection unit 550 may determine ameasured pseudorange difference based on measured signals, e.g., theanomalous signal 615 and the non-anomalous signal 692, and determine anexpected pseudorange difference to the corresponding SVs 191, 192 (e.g.,based on an approximate location of the UE 500 and ephemeris data forthe SVs 191, 192), and identify at least one of the signals 615, 691 asanomalous if the difference between measured pseudorange difference andthe expected pseudorange difference differ by more than a thresholdamount, e.g., by more than 1%, 5%, or 10% of the measured pseudorange(or of the expected pseudorange).

The anomaly detection unit 550 may be configured to identify signalinconsistencies based on ephemeris data. Spoofing signals may bebroadcast with significantly higher signal strength than actual SPSsignals, but may be broadcast inconsistent with known ephemeris data forthe actual satellites. A UE may perform a broad/standalone search forthe strongest signals, and thus may lock onto a strong signal allegedlybelonging to a constellation and use that signal to determine searchwindows for other signals of the constellation. The UE may thus only seesignals from the spoofed constellation as long as the other spoofedsignals are consistent with the spoofed constellation based on analmanac and/or collective ephemeris and/or long-term orbital predictionsof the actual constellation, which the UE may have obtained and stored.The anomaly detection unit 550 may be configured to compare the receivedsignals against the existing orbital data (almanac, ephemeris, long-termephemeris (i.e., long-term orbital)) for the SVs of the constellation.The anomaly detection unit 550 may be configured to identify thereceived signal(s) spoofed signal(s) base on the received signals beinginconsistent with (e.g., not matching) expectation(s) based on thelocation of the UE 500 and known orbital information for theconstellation. Thus, if the spoofed satellites are not consistentlygenerated by the signal emulator(s) 700, e.g., the broadcast ephemerisdata of the signals are not consistent with ephemeris data, long-termorbital predictions, and/or GNSS almanac data stored by the UE 500, thenthe anomaly detection unit 550 may identify the signals as spoofed. Theinconsistency(ies) may, for example, be that the signals purport to befrom different locations than the stored data indicate the locations tobe, e.g., spoofed satellites being present at locations (e.g., together)when the stored ephemeris data indicates that the satellites are atother locations (e.g., not together).

The anomaly detection unit 550 may be configured to determine timeconsistency of one or more received, allegedly satellite signalsrelative to one or more other sources of time. The anomaly detectionunit 550 may obtain the time of day (TOD) from the first allegedsatellite signal to which the UE 500 locks. This TOD may be used forsearch windows for other signals, e.g., from the same purportedconstellation of satellites. The anomaly detection unit 550 may beconfigured to determine consistency of the TOD from the acquired signalrelative to a time kept by the UE 500 (e.g., based on apreviously-determined time and time propagation of thepreviously-determined time using a local clock of the UE 500), one ormore times determined from one or more terrestrial-based networks (e.g.,WWAN, WiFi, WAN, Internet, etc.), and/or one or more times determinedfrom one or more satellite constellations (e.g., the actualconstellation corresponding to a spoofed constellation and/or one ormore other constellations). The anomaly detection unit 550 may identifythe acquired signal as a spoofed signal if the corresponding TOD differsby more than one or more threshold amounts from one or more other timesources, with the anomaly detection unit 550 allowing for reasonableerror/discrepancy between the times, e.g., due to clock drift and/orother sources of known/acceptable error. The anomaly detection unit 550may be configured to identify significant time difference between theTOD indicated by a received signal to identify the received signal as aspoofed signal. The time difference may be considered different if thetime difference is more than a threshold amount that allows forpredictable, typical error between systems. The anomaly detection unit550 may be configured to cause a measurement from a signal identified asbeing spoofed to be ignored or de-weighted, e.g., by the locationdetermination unit 560.

The anomaly detection unit 550 may select which SPS signals to use toperform a consistency check, e.g., to determine received powerdifferences and/or pseudorange differences. For example, the anomalydetection unit 550 may be configured to select one or more SPS signalscorresponding to one or more respective SVs based on a priority of SVsand/or constellations. The anomaly detection unit 550 may, for example,select SPS signals for SVs based on levels of trust for the SVs and/orconstellations, and/or based on one or more other criteria. For example,a native SPS (i.e., an SPS owned by a country associated with the UE500) may be given a highest level of trust. For example, GPS may begiven highest trust (relative to other SPSs) by a UE associated with(e.g., believed to be presently in, or purchased in) the United Statesof America, Galileo by a UE associated with Europe, BeiDou by a UEassociated with China, and GLONASS by a UE associated with Russia.Non-native SPSs may be given lower trust, e.g., in a hierarchy of trustthat may depend, for example, on the native SPS. The UE 500 may use theSPSs in order of trust, for example, using the most trusted SPS or thetwo most trusted SPSs to determine an approximate location of the UE500, and use this approximate location to check consistency with one ormore of the remaining SPSs.

If the UE 500 is in or part of a moving vehicle, the consequences of asuccessful spoofing may have a greater impact than for spoofing ofanother device. The vehicle, however, may have one or more othersystems, e.g., redundancy systems, upon which the vehicle may rely toreduce or negate the effect(s) of the spoofing. For example, smallinaccuracies may be corrected by checking for consistency with a map andadjusting the location to be consistent with the map (e.g., to move avehicle location to a road). As another example, a vehicle may use inputfrom one or more cameras, one or more radar systems, one or more lidarsystems, and/or one or more sonar systems (and/or one or more othersystems) to determine, e.g., inter-vehicle spacing, inter-objectspacing, and/or location. Such systems may enable a self-driving vehicleto navigate without GNSS-based location at least for some amount oftime. One or more other systems, e.g., WiFi and/or WAN positioning, maybe used to determine or verify position, e.g., using one or morecrowd-sourced maps and one or more positioning techniques, e.g.,trilateration (based on ranges to base stations) or heat-map positioning(based on signal strengths and a map of signal strengths). Suchpositioning techniques may provide redundant localization data.

At stage 860, the UE 500 receives a base station signal 865 from the TRP300 (e.g., one or more of the base stations 120-123 or another basestation). The base station signal 865 may include a positioning signal(e.g., a PRS) and/or a communication signal. Signals from more than oneTRP 300 may be received.

At stage 870, the base station signal 865 may be used by the anomalydetection unit 550 to detect consistency between the base station signal865 and one or more SPS signals. For example, the anomaly detection unit550 may be configured to use the base station signal 865 from the TRP300 (e.g., from the BTS 120 or the BTS 123 as shown in FIG. 6) todetermine an approximate location of the UE 500. The unit 550 may beconfigured to use the approximate location to determine one or moreexpected received powers of one or more SPS signals and/or to determineone or more expected pseudoranges to one or more SVs. The unit 550 maybe configured to determine whether the expected received power(s) and/orthe expected pseudorange(s) is(are) consistent with measured receivedpower(s) and/or pseudorange(s) determined from a measured SPS signal ormeasured SPS signals. For example, the unit 550 may determine whethermeasured and expected received powers differ by less than a powerthreshold and/or whether measured and expected pseudoranges differ byless than a pseudorange threshold.

At stage 880, the UE 500 may perform a consistency check using one ormore other technologies, i.e., non-SPS technologies. For example, theanomaly detection unit 550 may be configured to obtain locationinformation based on radar, Lidar, WAN, and/or Wi-Fi technologies assuch information is available. The anomaly detection unit 550 may beconfigured to use the location information obtained by one or more ofthese other technologies to determine whether a location of the UE 500according to such information is consistent with one or more SPSsignals, e.g., consistent with received power level and/or determinedpseudorange or location. For example, the anomaly detection unit 550 mayobtain an approximate location using the signaling 630 (e.g., radar,lidar, sonar) between the UE 500 and the UE 114 to determine theapproximate location of the UE 500 based on a location of the UE 114 anda distance between the UE 114 and the UE 500. As another example, theanomaly detection unit 550 may use visual information to determine theapproximate location of the UE 500, e.g., by using visual information torecognize the landmark 640 and use a location of the landmark (e.g.,either stored in the memory 530, provided by the landmark 640, orprovided by another entity such as the server 400) as the approximatelocation of the UE 500. The anomaly detection unit 550 may combinetechnologies, e.g., using visual information of the landmark to identifythe landmark and obtain the location of the landmark, using radar todetermine a distance from the landmark, and using this distance and thelandmark location to determine the approximate location of the UE 500.As another example, the anomaly detection unit 550 may use informationregarding constraints on the location of the UE 500 to help identify SPSsignals as anomalous. For example, the anomaly detection unit 550 mayuse map information and information as to characteristics of the UE 500and/or a vehicle in which the UE 500 resides. Thus, for example, theanomaly detection unit 550 may compare determined location and/orpseudorange corresponding to an SPS signal to identify an SPS signal asanomalous that indicates that the UE 500 is in an impossible (or atleast highly unlikely) location, such as on land if the UE 500 is (orresides in) a boat, is in water if the UE 500 is (or resides in) a landvehicle such as car or truck (and is not on a ferry route), is displacedsignificantly from train tracks if the UE 500 is (or resides in) atrain, etc. As another example, the UE 500 may check with one or moreother UEs within communication range to determine whether a locationdetermined by the other UE(s) corresponds to an SPS signal measurementobtained by the UE 500. For example, the UE 500 may request a locationof another UE and/or may receive a notification (e.g., a safetynotification) pushed by another UE (e.g., the UE 114 shown in FIG. 6)that indicates a location of the other UE. The UE 500, e.g., the anomalydetection unit 550, may determine whether the location indicated by thenotification or provided in response to the request is consistent withan SPS signal measurement (e.g., pseudorange, location (e.g., atime-filtered location), etc.) obtained by the UE 500 from a receivedSPS signal to determine whether the received SPS signal is anomalous.

The anomaly detection unit 550 may be configured to re-perform one ormore consistency checks of stage 850, and/or to perform one or more ofthe consistency checks of stages 870, 880. The anomaly detection unit550 may be configured to perform such checks for every signal or basedon one or more criteria such as every N^(th) SPS signal or in responseto identifying an SPS signal as anomalous at stage 850. The anomalydetection unit 550 may be configured to perform different consistencychecks and/or different amounts of consistency checks based on asensitivity level of knowledge of the location of the UE 500. Forexample, the anomaly detection unit 550 for a smartphone may beconfigured not to perform consistency check beyond SPS signal checkingat stage 850 for an exercise application, but the anomaly detection unit550 for a military aircraft may be configured to perform everyconsistency check for which information is available. Checking, andre-checking, consistency of an anomalous SPS signal may help confirm orcontradict the initial identification of an SPS signal as anomalous. Ifan SPS signal is identified as anomalous but subsequent consistencychecking reveals that the SPS signal is consistent with one or moreother SPS signals and/or other forms of consistency checking, then theSPS signal may be re-identified as not anomalous.

At stage 890, the anomaly detection unit 550 may send positioninformation 892 (e.g., SPS signal measurement(s), pseudorange(s),location(s), signal source identity(ies), etc.) to a network entity, inthis example, the server 400. The anomaly detection unit 550 may beconfigured to send the position information, such as one or more SPSsignal measurements, to a network entity (e.g., the server 400, anotherserver, a TRP 300, etc.) as encrypted data. The anomaly detection unit550 may be configured to a timestamp in the position information. Theanomaly detection unit 550 may be configured to send the positioninformation in response to a command from a network entity and/or inresponse to performance of an operation by the processor related to aparticular scenario such as a point-of-sale transaction.

The processor 510 may be configured to use the identification of an SPSsignal as anomalous in one or more of a variety of ways. For example,the location determination unit 560 may respond to an SPS signal beingidentified as anomalous (e.g., due to source location discrepancy, timediscrepancy, etc.) by disregarding (e.g., ignoring) an SPS signalmeasurement of the SPS signal when determining location of the UE 500(e.g., not using a pseudorange based on the SPS signal in a positioningmethod). As another example, the location determination unit 560 mayde-weight an SPS signal measurement of an SPS signal identified asanomalous (e.g., reduce a weighting of the SPS signal measurement orweight the SPS signal measurement less than other SPS signalmeasurements) when used in a positioning technique (e.g., an algorithm)for determining the location of the UE 500. As another example, thelocation determination unit 560 may be configured to determine andcompare multiple location estimates for the UE 500 (e.g., using WWAN,WiFi, GLONASS, GPS, BeiDou, Galileo, Kalman-filter-propagated location,etc.) and to use the largest consistent collection of such informationto determine the location of the UE 500. Also or alternatively, thelocation determination unit 560 may be configured to use one or morelocation estimates from the most trusted one or more sources of locationestimate information (e.g., measurements for determining UE location orestimates of the UE location). Trusted sources may include, for example,base stations that are difficult to spoof such as bi-directional sourcessuch as WAN base stations because successful spoofing of such basestations may entail spoofing a connection to the network. Other examplesof trusted sources may include visual and/or audio input devices such asa camera and/or a microphone, and/or ranging devices such as radar,lidar, and/or sonar sensors. These entities may be consideredtrustworthy because images captured by a camera and/or audio captured bya microphone and/or ranges determined from UE sensors to determine UElocation may be difficult to spoof, especially to spoof consistent withone or more other sources of location information and especially overtime (e.g., for a moving UE). As another example, the anomaly reportingunit 570 may respond to identifying one or more SPS signals as anomalousby reporting the anomaly(ies) to one or more other entities such as anetwork entity and/or other UEs. For example, the anomaly reporting unit570 may report to nearby UEs that a particular signal is being spoofed,and/or may report the spoofed signal to a network entity for widespreadwarning (e.g., nationwide warning, especially during a time of nationalconcern such as a war). As another example, the processor 510 mayrespond to identifying one or more SPS signals as anomalous bytriggering an inquiry. For example, the processor 510 may provide aninquiry (e.g., “Are you presently in the middle of a lake?”) through auser interface of the UE 500 to a user of the UE 500 to help determinewhether the SPS signal was incorrect.

Numerous variations of the flow 800 may be implemented. For example, theUE 500, e.g., the processor 510, may be configured to receive SPSsignals (real and/or spoofed) via the SPS receiver 515, such as in stage810 and/or stage 830. The processor 510 may be configured to respond toreceiving a request for authorization for a secure transaction, e.g., afinancial transaction, by conveying information, via the interface 520(e.g., via the wireless transmitter 242 and the antenna 246), to anetwork entity such as the TRP 300 and/or the server 400, e.g., theposition information 892 to the server 400. The conveyed information mayfacilitate and/or enable the secure transaction by confirming a locationof the UE 500, e.g., to be proximate (or not) to an entity requestingthe transaction. The conveyed information may include SPS measurementscorresponding to real and/or spoofed SPS signals, identities of the realand/or spoofed SVs corresponding to the SPS signals, a position of theUE based on one or more positioning techniques other than an SPSpositioning technique, and a timestamp. The timestamp may correspond tothe time corresponding to receipt of the SPS signals and thus the timecorresponding to the position of the UE 500 determined from the SPSsignals. The timestamp may include multiple timestamps (indications oftime) as the SPS signals may be received over a period of time. Theconveyed information, e.g., the SPS measurements, may be encrypted bythe UE 500. The SPS measurements may include pseudoranges (i.e.,processed signal measurements) and/or raw signal measurements (e.g.,RSRP, time of arrival, etc.).

Another example alternative to the flow 800 may include a subset of thestages shown in the flow 800. For example, the UE 500 may receive andmeasure positioning signals, e.g., at least one non-spoofed SPS signalas at stage 830 and at least one spoofed SPS signal as at stage 810. TheUE 500, e.g., the anomaly detection unit 550, may determine a differencebetween multiple positioning signal measurements, e.g., between ameasurements of a spoofed SPS signal and a measurement of a non-spoofedSPS signal. The anomaly detection unit 550 may determine that thedifference (e.g., a power difference, a pseudorange difference, a timeof day difference, etc.) is greater than a threshold difference, e.g.,as at stage 850. The location determination unit 560, possibly incombination with the anomaly detection unit 550, may determine alocation of the UE 500 without using or de-weighting a positioningsignal measurement in response to the anomaly detection unit 550flagging the corresponding signal as a spoofed signal (e.g., in responseto the difference exceeding the threshold difference).

Another example alternative to the flow 800 may include a subset of thestages shown in the flow 800. For example, the UE 500 may receive andmeasure location signals including an alleged satellite positioningsignal. The anomaly detection unit 550 may determine a differencebetween a measurement (e.g., power, pseudorange, etc.) of the allegedsatellite positioning signal (or multiple SPS signals), which may bespoofed, and one or more expected satellite positioning signalmeasurements. The expected measurement(s) may be based on ephemeris datafor one or more satellites and a location estimate for the UE 500, e.g.,based on one or more terrestrial-based positioning signals, one or moreterrestrial-based communication signals, one or more other satellitepositioning signals, and/or may be a maximum power expected from anysatellite vehicle. The anomaly detection unit 550 may determine that thedifference is greater than a threshold difference (e.g., if thesatellite positioning signal is spoofed). For example, the expectedmeasurement may be a maximum power expected from any satellite vehicleand the threshold may be 0 dBm such that if the measurement of thealleged satellite signal has a power exceeding the maximum expectedpower, then the anomaly detection unit 550 may identify the satellitepositioning signal as being spoofed or anomalous. The locationdetermination unit 560 may determine a location of the UE 500 usingmeasurements of the location signals while excluding (or de-weighting)the measurement of the alleged satellite signal.

Referring to FIG. 9, with further reference to FIGS. 1-8, a method 900of determining UE location in the presence of one or more spoofed SPSsignals includes the stages shown. The method 900 is, however, anexample only and not limiting. The method 900 may be altered, e.g., byhaving stages added, removed, rearranged, combined, performedconcurrently, and/or having single stages split into multiple stages.For example, one or more stages or portions of stages from the flow 800may be included in the method 900. As another example, one or more ofstages 930, 940, 950 may be omitted from the method 900.

At stage 910, the method 900 includes obtaining UE location information.The location information may include a location or information that maybe used in determining a location of the UE 500, e.g., one or moremeasurements, one or more ranges (e.g., pseudoranges), etc. For example,the processor 510 may receive an indication of the location of the UE500 via the interface 520. The indication of the location of the UE 500may, for example, be a cell sector center for a serving TRP 300 for theUE 500. As another example, the location of the UE 500 may be propagatedforward from a Kalman filter or other filter and/or another locationestimator. The location may be determined from GNSS, WiFI, WAN, WLAN,and/or Bluetooth® (and/or another short-range wireless technology)signaling, from one or more images obtained by the camera 218, and/orfrom information from one or more of the sensor(s) 213, and/or anycombination thereof, and possibly in combination with prior stateinformation. As another example, the processor 510 may determine one ormore measurements of one or more satellite signals and/or one or moreterrestrial-based signals. As another example, the locationdetermination unit 560 may use terrestrial-based signal measurements todetermine a location of the UE 500 using RTT, multi-RTT, OTDOA, sidelinkpositioning, and/or one or more other positioning techniques. As anotherexample, the obtained location information may be a location determinedfrom satellite signals from one or more GNSS constellations. As anotherexample, the obtained location information may be a location determinedusing one or more non-GNSS information such as WAN, WiFi, sonar, lidar,and/or radar information, and/or one or more camera images (e.g.,through recognition of an object of known location), and/orinter-vehicle/inter-device communication (e.g., positions of neighboringdevices). As another example, the processor 510 may retrievepreviously-determined location information, e.g., one or morepreviously-determined measurements and/or a previously-determinedlocation of the UE 500, from the memory 530. The processor 510 may applydead reckoning to a retrieved location to determine a present locationestimate or may use the previously-determined location as the presentlocation estimate. Still other techniques may be used alone or incombination with one or more techniques mentioned to obtain the UElocation information. The location information obtained at stage 910 mayinclude multiple locations, e.g., multiple locations over time.

At stage 920, the method 900 includes receiving spoofed signals. Thedescription of the method 900 assumes that multiple spoofed signals arereceived, but a single spoofed signal could be received. The processor510 of the UE 500 receives the spoofed signals and determines one ormore appropriate measurements for each of the signals. The processor 510may determine location information based on the spoofed signals, e.g.,one or more signal measurements and/or one or more locations. Theanomaly detection unit 550 may not know that a signal is spoofed, butmay consider signals to be from a possibly-spoofed constellation wherethe signals are purportedly from the possibly-spoofed constellation andhave received signal powers significantly higher than received signalpowers of signals from one or more other constellations or even from thepurported constellation. Spoofed signals will typically be rebroadcastand thus have a time delay, but have a stronger signal than the signalbeing spoofed and the anomaly detection unit 550 may look for suchcharacteristics to determine that a signal is possibly spoofed orspoofed. Spoofed signals will often not be provided for all satelliteconstellations and/or all frequency bands. Also, WAN signals (for acooperative or uncooperative base station) are typically not spoofed asthe spoofer does not cooperate (to communicate) with the UE 500 and aneighbor list and/or base station almanac can be used to identify a fakebase station. The anomaly detection unit 550 may search for consistencyacross constellations, or attempt to communicate with a source of a WANsignal, and/or analyze a neighbor list or base station almanac toidentify a fake base station. The anomaly detection unit 550 may assumethat signals having one or more characteristics of spoofed signals(e.g., high power, inconsistent across constellations, associated with abase station that will not cooperate or is not in a neighbor list orbase station almanac, etc.) are spoofed signals and proceed to determinewhether this assumption is justified/correct in one or more of stages930, 940, 950.

At stage 930, the method 900 includes determining whether spoofedlocation information and the obtained location information areconsistent. For example, the location determination unit 560 may use thespoofed signals received at stage 920 to determine spoofed locationinformation for the UE 500, e.g., a spoofed location of the UE 500. Theanomaly detection unit 550 may compare location information determinedbased on the spoofed signals and location information obtained at stage910 to determine whether the obtained location information and thespoofed location information are consistent.

The anomaly detection unit 550 may determine whether the spoofedlocation differs substantially relative to a present obtained locationand/or a location history, e.g., whether there is a large discontinuity(larger than a threshold) between the spoofed location and the obtainedpresent location information, with a large discontinuity beingconsidered by the anomaly detection unit 550 as the spoofed and obtainedlocation information being inconsistent. For example, a spoofed locationmay differ significantly from one or more pseudoranges from one or moreother (non-spoofed) constellations and/or from one or more locationsdetermined from signals from one or more other constellations. Thethreshold may vary with a time difference between a present time and atime corresponding to the obtained location. For example, the anomalyunit 550 may determine that the spoofed location is inconsistent withthe obtained location if the spoofed location is significantly differentthan the obtained location corresponding to a most-recent time (themost-recent obtained location) without a reasonable explanation. A speedcorresponding to a distance difference between the spoofed location andthe most-recent obtained location divided by the time difference betweenthe spoofed location and the most-recent obtained location should bereasonable. What is reasonable may be based on historical locations ofthe UE 500, motion of the UE 500, and/or other information (e.g., userinput indicating a flight). For example, a vehicle speed or less may bereasonable unless the UE 500 is determined to have been travelling byairplane, or a running speed or less may be reasonable if the UE 500 isdetermined to be undergoing pedestrian motion (e.g., as determined by anIMU of the UE 500).

Also or alternatively, the anomaly detection unit 550 may determinewhether visible satellites of a spoofed constellation and/or searchwindows of the spoofed signals are consistent with a location of theobtained UE location information. The location of the obtained UElocation information may be determined from SPS signals that are weakerthan the spoofed signals and/or from one or more other indications oflocation. The anomaly detection unit 550 may use the location(s) of theobtained UE location information (e.g., determined by the locationdetermination unit 560 using the weaker signals) to determine whichsatellites of the possibly-spoofed constellation should be visible tothe UE 500 and/or determine expected search windows/pseudoranges to thesatellites of the possibly-spoofed constellation. The anomaly detectionunit 550 may search for satellites of the possibly-spoofedconstellation. Also or alternatively, the anomaly detection unit 550 maydetermine expected visible satellites, signal strengths, and/or searchwindows/pseudoranges for other constellations based on a determinedlocation using the signals of the possibly-spoofed constellation, i.e.,the signals assumed to be spoofed. If fewer (e.g., more than a thresholdquantity fewer) than all of the satellites (e.g., of thepossibly-spoofed constellation and/or of the other constellation(s))expected to be visible are visible and/or the searchwindows/pseudoranges are significantly different than expected, then theanomaly detection unit 550 may conclude that the location information ofthe possibly-spoofed constellation and the obtained location informationare inconsistent.

Also or alternatively, the anomaly detection unit 550 may determinewhether locations determined from multiple satellite constellations areconsistent with each other and/or with location determined from one ormore non-GNSS techniques. For example, the anomaly detection unit 550may determine the location of the UE 500 based on signals from differentconstellations and compare the locations. If the locations differ bymore than a threshold amount, the anomaly detection unit 550 mayidentify at least one of the constellations as being spoofed. Theanomaly detection unit 550 may compare one or more GNNS-determinedlocations of the UE 500 against a location determined using a non-GNSStechnique and identify a GNSS-determined location as being the result ofspoofing if the GNSS-determine location differs from thenon-GNSS-determined location by more than a threshold amount.

Also or alternatively, the anomaly detection unit 550 may determinewhether pseudoranges determined using different GNSS frequency bands areconsistent. For example, if pseudoranges determined from L1 signals andL5 signals are inconsistent (e.g., not within a threshold of each other,accounting for tropospheric and ionospheric effects on the two differentfrequencies for various satellites), then the anomaly detection unit 550may conclude that one or more of the signals of at least one of thefrequency bands are being spoofed. The anomaly detection unit 550 mayattempt to determine which of the signals are being spoofed, e.g., bycomparing the pseudoranges to non-GNSS determined information. Ifsignals are determined not to be spoofed, then those signals may be usedto determine the location of the UE 500.

Consistency checking may be performed at a measurement engine level or apositioning engine level. The measurement engine may include RF andbaseband processing components to determine GNSS pseudoranges that canbe sent to the positioning engine to be combined with information fromother sources. Measurement-engine-level consistency checking looks forsuspicious jumps, suspicious power levels, and/or pseudoranges thatdisagree with pseudoranges determined based on time andephemeris/long-term ephemeris/orbital information and an approximatelocation of the UE 500. The positioning engine may include a Kalmanfilter and GNSS processing/pseudorange management components, e.g., tode-weight spurious pseudoranges, apply a least-squares processing, etc.For example, a least-squares fit of GNSS pseudoranges may be performedfor multiple sources and pseudoranges that are inconsistent with otherpseudoranges (or information/signals from which the inconsistentpseudoranges are determined) are de-weighted. This checking identifiesinconsistencies of location information (e.g., pseudoranges) determinedfrom spoofed satellite signals with location information determined fromother sources (e.g., WAN, WiFi, sensor(s) (e.g., steering wheel, tirerotation tracker, accelerometer, gyroscope, camera, etc.)).Positioning-engine-level consistency checking looks for predictedlocations or pseudoranges that are inconsistent with other sources ofsuch information.

If the spoofed and obtained location information are determined to beinconsistent (e.g., by the anomaly detection unit 550) at stage 930,then the method 900 proceeds to stage 935. At stage 935, the processor510, e.g., the location determination unit 560, may ignore (e.g.,discard) or de-weight location information corresponding to one or moresignals from the possibly-spoofed constellation, e.g., one or moremeasurements of such one or more signals and/or one or more locationsbased on such one or more signals. From stage 935, or from stage 930 ifthe spoofed and obtained location information are determined to beconsistent, the method 900 proceeds to stage 940.

At stage 940, the method 900 includes determining whether timedetermined from spoofed signals and the obtained location informationare consistent. For example, the anomaly detection unit 550 may read atime of day (TOD) indicated by one or more of the spoofed signals,propagate the read time to a present TOD, and combine (e.g., average)multiple present TODs corresponding to multiple spoofed signals. Theanomaly detection unit 550 may determine a present TOD from one or moreother sources, e.g., a terrestrial-based network (e.g., WAN, theInternet, etc.) and/or one or more GNSS constellations. The anomalydetection unit 550 may compare the present TOD determined from thespoofed signals and the present TOD determined from the other source(s).If the two present TODs differ by more than a threshold amount, then theanomaly detection unit 550 concludes that the spoofed and obtained timesare inconsistent.

The anomaly detection unit 550 may determine whether time determinedfrom signals purportedly from different constellations is consistent.The time should be consistent across all constellations. If the timedetermined from a constellation is significantly different (e.g., bymore than a threshold time) from time determined by other constellationsand/or other non-GNSS sources, or if the time determined from aconstellation indicates a jump in time compared to a predicted time,e.g., propagated time using a base station frequency as a reference,then (one or more signals of) the constellation from which the time wasdetermined may be identified as having been spoofed. Spoofing of aconstellation (i.e., one or more signals of the constellation) may beidentified in particular if the determined time is delayed relative totime determined by other sources. Thus, the anomaly detection unit 550may look for a time with added delay to identify the signal(s) fromwhich the time was determined as anomalous (e.g., spoofed).

If the spoofed and obtained times of day are determined to beinconsistent (e.g., by the anomaly detection unit 550) at stage 940,then the method 900 proceeds to stage 945. At stage 945, the processor510, e.g., the location determination unit 560, may ignore (e.g.,discard) or de-weight location information corresponding to one or moresignals from the possibly-spoofed constellation, e.g., one or moremeasurements of such one or more signals and/or one or more locationsbased on such one or more signals. From stage 945, or from stage 940 ifthe spoofed and obtained times of day are determined to be consistent,the method 900 proceeds to stage 950.

At stage 950, the method 900 includes determining whether locationand/or movement and/or one or more other parameters determined fromspoofed signals is/are rational. For example, the anomaly detection unit550 may determine that the location of the UE 500 is in an area knownfor spoofing, or at least known for spoofing of the constellationcorresponding to the signals that the anomaly detection unit 550 hasassumed are spoofed for purposes of evaluating the signals to verifywhether the signals are spoofed or not. If the determined location putsthe UE 500 in a known-spoofed location, then the anomaly detection unit550 may conclude that the spoofed signals are indeed spoofed or mayincrease a spoofing confidence score indicative of the confidence of theanomaly detection unit 550 that a signal (e.g., the signals assumed tobe spoofed) are spoofed (or decrease a no-spoofing confidence scoreindicative of a confidence of the anomaly detection unit 550 that asignal is not spoofed). As another example, the anomaly detection unit550 may determine that the location of the UE 500 is irrational if thelocation is unexplained or unexpected, e.g., being in a differentcountry than a previous location without an indication of an expectedchange of location to that country (e.g., travel plans in a calendar,indication of purchase of a plane ticket to that country, etc.). Asanother example, the anomaly detection unit 550 may determine that thelocation of the UE 500 is irrational if the location is indicative of asudden significant change in location (perhaps using one or moredifferent criteria than used at stage 930). As another example, theanomaly detection unit 550 may determine that movement of the UE 500 isirrational if the movement is unexpected, e.g., based on one or morecriteria such as location and/or location history of the UE 500. Theanomaly detection unit 550 may, for example, determine that a speed ofthe UE 500 above about 15 miles per hour (e.g., above about 7 m/s) withthe UE 500 disposed in a shopping mall is irrational. The anomalydetection unit 550 may, as another example, determine that a speed ofthe UE 500 below about 50 miles per hour (e.g., below about 22 m/s) withthe UE 500 disposed in an airplane and a location history indicating aspeed consistent with air travel. The anomaly detection unit 550 may, asanother example, determine that a sudden change in speed of the UE 500is irrational if the speed changes by more than a threshold rate (e.g.,by more than a threshold percentage of a prior speed within a thresholdamount of time). As another example, the anomaly detection unit 550 maydetermine whether there is a sudden change in signal strength ofreceived signals purportedly from the same constellation. If the signalstrength of signals from a constellation change from weak to strong suchthat the strong signals would be assumed to be spoofed if the strongsignals were detected first, then the anomaly detection unit 550 maydetermine this change to be irrational.

Sudden jumps in pseudorange, time, or frequency may be used to identifyspoofed signals. For example, signals that lead to a sudden jump in atime-frequency bin, or a locked frequency and locked time (in afrequency tracking loop and time tracking loop) may be identified asspoofed.

If irrational location, movement, and/or other parameter(s) is/aredetected at stage 950, then the method 900 proceeds to stage 955. Atstage 955, the processor 510, e.g., the location determination unit 560,may ignore (e.g., discard) or de-weight location informationcorresponding to one or more signals from the possibly-spoofedconstellation, e.g., one or more measurements of such one or moresignals and/or one or more locations based on such one or more signals.From stage 955, or from stage 950 if no irrational location, movement,or other parameter is detected, the method 900 proceeds to stage 960.

At stage 960, the location determination unit 560 selects signalinformation to be used for determining location of the UE 500. Forexample, the location determination unit 560 may analyze the measuredsignals from spoofed and non-spoofed sources and determine the signalsthat are consistent with each other and not assumed to be spoofed (e.g.,have high confidence of not being spoofed). The signals may bedetermined to be consistent if, for example, the signals are of expectedsignal strengths (within respective expected signal strength ranges),pseudoranges corresponding to all the signals overlap in a common area,and/or the signals have not been determined, at stage 935, 945, or 955,to be ignored. As another example, the location determination unit 560may be configured to identify signals with high confidence (e.g., abovea threshold confidence value) of not being spoofed. For example, thelocation determination unit 560 may be configured to identify signalscorresponding to signal sources that are difficult to spoof and/or arehistorically reliable as not being spoofed. The location determinationunit 560 may be configured to assign or determine a confidence scorecorresponding to the signals, e.g., based on historical reliabilityand/or historical difficulty in spoofing the signals, indicia oflikelihood of spoofing (e.g., consistency with other signals, parametervalue(s) within expectation(s), etc.). The location determination unit560 may be configured to select signal information (e.g., signalmeasurements) corresponding to the consistent signals and/or the signalswith high confidence (above a threshold confidence) of not being spoofedfor use in determining location of the UE 500.

At stage 970, the location determination unit 560 may determine thelocation of the UE 500. If sufficient signal information is selected atstage 960 to enable determination of the location of the UE 500, thelocation determination unit 560 determines the location of the UE 500using at least some of the selected information. The locationdetermination unit 560 may use one or more positioning techniques basedon the selected signal information.

At stage 980, the processor 510 reports a location and/or a no-spoofingconfidence, or a rejection (spoof detection) condition. For example, thelocation determination unit 560 may report, via the interface 520, thelocation of the UE 500 if the location determination unit 560 was ableto determine a location (e.g., with one or more desired criteria such asa threshold level of accuracy). The location determination unit 560 mayreport a no-spoofing confidence level alone, or with a location if alocation is reported. The no-spoofing confidence may indicate aconfidence of the location determination unit 560 that the location isnot based on any spoofed signals. The anomaly reporting unit 570 mayreport a rejection condition and/or a spoof detection indication, e.g.,if no location was determined or if the no-spoof confidence level isbelow a threshold confidence. The spoof detection may be dependent upona use or application of a location of the UE 500. For example, for acritical application such as a military application or a financialtransaction (or a financial transaction of at least a threshold monetaryamount), the confidence level required for a location of the UE 500 tobe reported may be higher than for a non-critical application (e.g.,directions within a shopping mall). Also or alternatively, if thelocation of the UE 500 is determined to be in a suspect location (i.e.,a location of likely spoofing activity), then the confidence levelrequired for a location of the UE 500 to be reported may be higher thanfor other, non-suspect, locations. The location of the UE 500, possiblyin combination with the nature of an information request (e.g., for afinancial transaction or other sensitive and/or secure transaction), maybe used by the processor 510 to trigger one or more safety precautionssuch as shutdown of the UE 500, prevention of transmission by the UE 500of location and/or other information, erasure of more or all of thememory 530, message transmission (e.g., indicating that a suspect actionis being requested (possibly due to the location of the UE 500) and/orthat the UE 500 is compromised (e.g., being spoofed, possibly stolen,etc.), secure authentication, etc. Secure authentication may betriggered to require input of authentication information such as afingerprint, a voice print, a facial image, one or more retinal images,a combination of two or more of these, and/or other information. Uponinput of such information and verification of the information (e.g.,matching securely-stored information), a rejection of location reportingand/or other action(s) may be overridden and approved.

Referring to FIG. 10, with further reference to FIGS. 1-9, a method 1000of detecting an anomalous SPS signal includes the stages shown. Themethod 1000 is, however, an example only and not limiting. The method1000 may be altered, e.g., by having stages added, removed, rearranged,combined, performed concurrently, and/or having single stages split intomultiple stages. For example, one or more stages may be added to themethod 1000 and/or the method 1000 repeated (e.g., periodically) todetermine whether a signal that was spoofed is no longer being spoofedor that a non-spoofed signal can be determined and used for positioning.

At stage 1010, the method 1000 includes receiving, at a user equipment,a first SPS signal. For example, the SPS receiver 515 may receive one ormore SPS signals from one or more SVs in one or more constellations. TheSPS receiver 515 may provide the SPS signals to the processor 510, i.e.,provide transduced electrical versions of the wireless received SPSsignals to the processor 510. The SPS receiver 515 along with theprocessor 510 may comprise means for receiving the first SPS signal.

At stage 1020, the method 1000 includes determining, at the userequipment, whether the first SPS signal is anomalous. Stage 1020 mayinclude one or more of various techniques to determine whether the firstSPS signal is anomalous, e.g., being out of the ordinary, unexpected andpossibly incorrect/inaccurate. The processor 510 along with the memory530, and possibly the SPS receiver 515, may comprise means fordetermining whether the first SPS signal is anomalous, e.g., inaccordance with the discussion herein, in particular the furtherdiscussion of stage 1020 below.

Stage 1020 may include performing one or more consistency checks, e.g.,as discussed with respect to stage 850. The anomaly detection unit 550may determine whether the first SPS signal and the second SPS signalyield consistent location and/or time measurements, e.g., consistencybetween historical measurement(s) (e.g., of location (possibly locationover time such as speed and travel heading)) and present measurement(s)and/or consistency between SPS measurement(s) and non-SPS measurements(e.g., location and/or time determined by other (non-SPS) means). Aspoofed signal may, for example result in a jump in time and/orfrequency of the received signals, e.g., due a time loop of the UE 500changing from being locked onto a non-spoofed signal to being locked toa spoofed signal and/or due a frequency loop of the UE 500 changing frombeing locked onto a non-spoofed signal to being locked to a spoofedsignal. Thresholds on phase offset and frequency may be used to set asearch window for satellite signals to help prevent measurement ofspoofed signals. Stage 1020 may comprise, for example, determiningwhether an actual measurement difference, between a first SPS signalmeasurement of the first SPS signal and a second SPS signal measurementof a second SPS signal, is consistent with an expected measurementdifference between expected SPS signals from a first SV (satellitevehicle) and a second SV, wherein the first SPS signal has a firstformat corresponding to the first SV and the second SPS signal has asecond format corresponding to the second SV. For example, the anomalydetection unit 550 may determine whether the actual measurementdifference and the expected measurement difference are consistent bydetermining whether the actual measurement difference of SPS signals iswithin a threshold of an expected measurement difference of SPS signals.The actual and expected measurement differences may be received powerdifferences and the threshold may be a power threshold. The thresholdmay be, for example, a relative threshold (e.g., a percentage or amaximum ratio) or a raw (absolute) value (e.g., a power quantity, e.g.,an amount of watts or dBm). The first and second SPS signals may havedifferent carrier frequencies and the first and second SVs may be thesame SV or different SVs. The actual and expected measurementdifferences may be power differences of power measurements (actual andexpected). The processor 510 may determine the expected measurementdifference using SV location information such as ephemeris data and/or(long-term) orbital information, such as ephemeris data and/or orbitalinformation for the first SV and the second SV respectively, e.g.,estimating received power based on known location of an SV andapproximate location of the UE 500, and thus estimating a range betweenthe UE 500 and the SV and determining an estimated expected receivepower from the estimated range. As another example, determining whetherthe actual and expected measurement differences are consistent maycomprise determining whether a difference of pseudoranges based on SPS(actual or spoofed) signals is within a threshold (relative or absolute)of an expected pseudorange. For example, the processor 510 may determinethe expected pseudorange difference by using SV location information todetermine expected ranges between the UE 500 and the SVs correspondingto the (actual or spoofed) SPS signals used to determine the actualpseudorange difference. If the pseudorange difference based on SPSsignals differs by more than a threshold from the expected pseudorangedifference, then the first SPS signal may be labeled anomalous. Asanother example, the first SPS signal measurement may be a first time(e.g., first TOD), the second SPS signal measurement may be a secondtime (e.g., second TOD), and determining whether the first SPS signal isanomalous comprises determining whether an actual difference between thefirst and second times is within a threshold of an expected differenceof the first and second times (e.g., based on SV location information ofsatellite locations and an estimated location of the UE). Times shouldbe consistent (though not necessarily identical, e.g., for differentconstellations), and a signal yielding an inconsistent time may bedeemed anomalous. The processor 510 may obtain ephemeris data fromsatellites via the SPS receiver 515 and/or from one or more TRPs 300 viathe interface 520. SV location information may be stored in the memory530 and/or obtained by the processor 510 via the interface 520 (e.g.,from the server 400). The processor 510, possibly in combination withthe memory 530 and/or the interface 520, in combination with the SPSreceiver 515, may comprise means for determining whether the actualmeasurement difference is consistent with the expected measurementdifference.

The SPS signals compared to determine the measurement differences may befrom the same SV (or purportedly from the same SV), e.g., with differentcarrier frequencies, or may be from different SVs from the sameconstellation or from different constellations. For example, spoofedsignals may be consistent for a constellation, e.g., with multiplespoofed signals provided to yield a consistent location determined usingthe spoofed signals, but will differ significantly from a locationdetermined using non-spoofed constellation signals. Also, for a givensatellite, a measurement of a pseudorange/time/code phase using aspoofed signal will jump compared to the pseudorange/time/code phaseusing a non-spoofed signal. Thus, the first SPS signal may be determinedto be anomalous if a jump is detected between measurements derived fromthe first SPS signal and the second SPS signal allegedly from the samesatellite. As another example, the first and second SPS signals maycorrespond to the same satellite but different frequency bands (e.g.,two of L1, L2, and L5). Satellite signals may only be spoofed for onefrequency band, and thus a significant measurement difference based onsignals allegedly from the same satellite but of different frequenciesmay be used to identify at least one of the signals as being anomalous.If a signal yields a measurement that is consistent with othermeasurements (e.g., from another frequency band, from anotherconstellation), then that signal may be deemed non-anomalous and if asignal yields a measurement that is not consistent with othermeasurements, then that signal may be deemed anomalous. As anotherexample, the first and second SPS signals may correspond to first andsecond SVs of different constellations. If measurements of signals fromdifferent constellations are inconsistent (accounting for expecteddifferences), then the first SPS signal may be deemed anomalous. Forexample, the second SPS signal may be chosen from the GLONASSconstellation because each satellite has a unique sub-band, makingspoofing more difficult. As another example, measurements from signalsfrom multiple constellations may be compared against a measurement fromthe first SPS signal for consistency. For example, Beidou III, GPS, andGalileo use the same L1 frequency and thus an impact on any of theseconstellations (e.g., delay between L1 and L5 timing, effects onDoppler/time windows and pseudoranges) should be similar for all of theconstellations. If an impact seen in one of these constellationsaccording to a signal (the first SPS signal) allegedly from one of theseconstellations is different from impacts seen across the otherconstellations, then the first SPS signal is determined to be anomalous.

Also or alternatively, stage 1020 may include determining whether areceived power of the first SPS signal exceeds a maximum expected SPSsignal received power. For example, the anomaly detection unit 550 maydetermine whether the received power of an alleged SPS signal exceeds amaximum expected SPS signal received power for the location of the UE500 from the SV that allegedly sent the alleged SPS signal based on anestimate of the location of the UE 500 and SV location information forthe SV that allegedly sent the alleged SPS signal. As another example,the anomaly detection unit 550 may determine whether the received powerexceeds a maximum power expected from any SV anywhere on Earth. Themaximum expected signal strength may be dependent on the receiver, e.g.,components of the receiver such as one or more antennas, one or moreLNAs (low-noise amplifiers), etc. The maximum expected signal strengthmay be programmed into a device during manufacture and based on thedevice type (e.g., the components used) and may be based on theoreticaland/or experimental values determined for the device type. The maximumexpected signal strength may be determined for a particular receiverthrough measurements, e.g., of satellite signals with clear sky. Themaximum expected signal strength may be crowd sourced by collectingmeasurements from multiple devices. As another example, a crowd-sourcedvalue may be used as a seed value of maximum expected signal strengthand then calibrated by the individual receiver using satellite signalmeasurements made by the receiver. The processor 510, possibly incombination with the memory and/or the interface 520, in combinationwith the SPS receiver 515, may comprise expectation means fordetermining whether the received power of the first SPS signal exceedsthe maximum expected SPS signal received power.

Also or alternatively, stage 1020 may include determining whether thefirst SPS signal originated from an SV location consistent with first SVlocation information (e.g., ephemeris data and/or orbital information)for the first SV. For example, the anomaly detection unit 550 mayperform a sky aperture test as discussed with respect to stage 820. Forexample, the anomaly detection unit 550 may determine which SVs shouldbe visible to the UE 500 and determine whether those SVs are indeedvisible. The anomaly detection unit 550 may determine which SVs shouldbe visible by, for example, using SV location information and anapproximate location of the UE 500 and a present time. As anotherexample, the anomaly detection unit 550 may determine from which portionof the sky an SPS signal was received, and independently determine(e.g., from independent information) whether the SV from which the SPSsignal was purportedly sent (e.g., the SV that is known to send SPSsignals of the format of the received SPS signal) is presently in thatportion of the sky. The anomaly detection unit 550 may identify the SPSsignal as anomalous if the independent information indicates that the SVis not in the portion of the sky corresponding to the received SPSsignal, which may be a spoofed SPS signal. For example, a directionalantenna or combination of antennas may be used to determine an angle ofarrival of a signal and compare that angle with an expected angle ofarrival based on SV location information and an approximate location ofthe UE 500. Multiple spoofed signals allegedly for different SVs mayoriginate from the same location and thus if SV signals are grouped withthe same or very similar angles of arrival when expected angles ofarrival are spread apart, then the signals may be flagged as beingspoofed, and thus de-weighted, ignored, discarded, etc. As anotherexample, if the first SPS signal corresponds to an SV that should not bevisible, e.g., is low on the horizon or should be blocked (e.g., due tothe UE 500 being in an urban canyon), but is visible, then the first SPSsignal may be deemed to be anomalous. As another example, if more SVsignals corresponding to a constellation are visible than expected, thenone or more of the SV signals from that constellation may be deemedanomalous. The processor 510, possibly in combination with the memory530 and/or the interface 520, may comprise means for determining whetherthe first SPS signal originated from an SV location consistent first SVlocation information for the first SV.

Also or alternatively, stage 1020 may include determining whether afirst pseudorange, based on the first SPS signal, to the first SVdiffers by more than a first pseudorange threshold from an expectedpseudorange to the first SV based on a time-filtered location of theuser equipment. For example, the processor 510 may determine location ofthe UE 500 using a time-based filter such as a Kalman filter andidentify an SPS signal as anomalous if a corresponding pseudorangediffers by more than a threshold from a range based on the time-filteredlocation and known location of the SV corresponding to the SPS signal.Equivalently, the processor 510 may identify the SPS signal as anomalousif the corresponding pseudorange would place the UE 500 more than athreshold distance from the time-filtered location. The processor 510,possibly in combination with the memory 530, may comprise means fordetermining whether the first pseudorange differs by more than the firstpseudorange threshold from the expected pseudorange.

Also or alternatively, stage 1020 may include determining that a firstlocation, of the user equipment, based on the first SPS signalmeasurement corresponds to at least one of an unexpected location or ahigh likelihood of anomaly location. For example, the anomaly detectionunit 550 may determine that the location of the UE 500 is in a city,county, state, or country unexpectedly (e.g., without user input, e.g.,in a calendar, indicating travel to that city, county, state, or countryat the present time). As another example, the anomaly detection unit 550may determine that the location of the UE 500 changed at a faster thanreasonable rate (e.g., a dramatic change in location in a short periodof time, such that to change between the locations, the speed of the UE500 would be unreasonable (e.g., faster than an airplane)). As anotherexample, the anomaly detection unit 550 may determine that the locationof the UE 500 differs significantly from an expected/predicted locationoutput by a filter (e.g., a Kalman filter), or not agreeing with othersources of location, or both. As another example, the anomaly detectionunit 550 may determine that the present location of the UE 500 is in anarea known to have a high number and/or high rate of signal spoofingand/or fraudulent transactions. The processor 510, possibly incombination with the memory 530, may comprise location/likelihood meansfor determining that the first location corresponds to at least one ofan unexpected location or a high likelihood of anomaly location.

Also or alternatively, stage 1020 may include determining whether one ormore base station signal measurements are consistent with the first SPSsignal measurement. For example, the processor 510 may determine whetherto disregard the first SPS signal measurement based on whether one ormore base station signal measurements are consistent with the first SPSsignal measurement, e.g., the base station signal(s) and the first SPSsignal all indicate that the UE 500 is in the same approximate location(e.g., within a threshold distance (e.g., 50 m, 100 m 1,000 m) of alocation, in the same city, in the same country, etc.). The processor510, possibly in combination with the memory 530 and/or the interface520, may comprise means for determining whether the first SPS signalmeasurement is consistent with one or more base station signalmeasurements.

Also or alternatively, stage 1020 may include determining whether ameasured signal quality of the first SPS signal is consistent with anexpected signal quality. For example, the anomaly detection unit 550will expect SPS signals to be noisy when the UE 500 is in certainenvironments such as an urban canyon. Thus, the anomaly detection unit550 may deem a signal to be anomalous in response to the signal havingnoise lower than a threshold and/or in response to the signal having asignal-to-noise ratio (SNR) higher than a threshold SNR based on thepresent environment of the UE 500, e.g., based on a coarse locationestimate (e.g., from E-CID, image analysis, serving cell location,etc.).

The method 1000 may include one or more of the following features. Forexample, the method 1000 may include responding to an initialdetermination that the first SPS signal is anomalous by determiningwhether the first SPS signal is anomalous based on a third SPS signalthat is different from any SPS signal on which the initial determinationwas based. For example, the anomaly detection unit 550 may make aninitial determination, based on the first SPS signal and/or the secondSPS signal (e.g., based on power difference of the SPS signals andexpected power difference), that the first SPS signal is anomalous. Theanomaly detection unit 550 may respond to this determination by usinganother SPS signal to determine whether the first SPS signal isanomalous. This may help detect changes that cause the first SPS signalto be identified as anomalous, but that are not due to the first SPSsignal being inaccurate (e.g., spoofed). This may help with locationdetermination by allowing the processor 510 to use the SPS signal todetermine location of the UE 500, e.g., without de-weighting. The method1000 may include selecting the third SPS signal such that a format ofthe third SPS signal corresponds to an SV that is in a differentconstellation than the first SV, i.e., in a constellation that excludes(does not include) the first SV.

Also or alternatively, the method 1000 may include one or more of thefollowing features. For example, the method 1000 may include respondingto an initial determination that the first SPS signal is anomalous bydetermining whether the first SPS signal is anomalous based on at leastone technology other than SPS technology. The anomaly detection unit 550may use one or more non-SPS technologies, in addition to or instead ofSPS technology, to determine whether the first SPS signal is anomalous.This may help determine whether the first SPS signal, although anomalousbased on SPS technology, is not a false SPS signal (e.g., spoofed orotherwise inaccurate). The method 1000 may include determining at leastone of how many other SV signals or what other technologies to use, fordetermining whether the first SPS signal is anomalous, based on asecurity level of knowledge of a position of the user equipment. Forexample, the processor 510 may determine one or more other SV signalsand/or one or more other technologies to use to determine whether thefirst SPS signal is anomalous. The processor 510 may determine thequantity of the SV signals and/or the quantity of other technologies,and which SV signal(s) and/or which technology(ies) to use based onsensitivity of the location of the UE 500, e.g., with more sensitive UElocation (based on the UE and/or based on the location) resulting in amore stringent anomaly determination (e.g., higher confidence ofdetermining whether a signal is inaccurate).

Also or alternatively, the method 1000 may include one or more of thefollowing features. For example, the method 1000 may include determininga dead-reckoning position of the user equipment, wherein determiningwhether the first SPS signal is anomalous is performed in response to atleast one of the first SPS signal measurement and the second SPS signalmeasurement being inconsistent with the dead-reckoning position of theuser equipment. For example, the processor 510 may use one or moresensor measurements (e.g., wheel rotation, odometer, steering wheel,gyroscope, accelerometer, and/or camera measurements, etc.) and a priorlocation of the UE 500 to determine a present location by dead reckoningand to trigger the determination of the whether the first SPS signal isanomalous in response to the dead reckoning position being inconsistentwith the first and/or second SPS signal measurement. For example, theprocessor 510 may trigger the anomaly determination in response to arange from the dead reckoning position to the first or second SVsignificantly differing (e.g., by more than a threshold) from arespective pseudorange based on the first or second SPS signal. Ansudden stop or jump in motion/location of the UE 500 that is notdetected from the sensor measurement(s) indicates that the SPS signal(s)is(are) spoofed.

Also or alternatively, the method 1000 may include one or more of thefollowing features. For example, the method 1000 may include taking oneor more actions in response to determining that the first SPS signal isanomalous. The method 1000 may include responding to the anomalydetermination by: disregarding the first SPS signal to determine theposition of the user equipment; or disregarding a pseudorange based onthe first SPS signal to determine the position of the user equipment; orde-weighting the first SPS signal to determine the position of the userequipment; or de-weighting the pseudorange based on the first SPS signalto determine the position of the user equipment; or using one or morebase station signal measurements to determine the position of the userequipment; or increasing one or more weightings of the one or more basestation signal measurements to determine the position of the userequipment; or sending an anomaly indication, indicating that the firstSPS signal is anomalous, to a first network entity; or sending a set ofSPS signal measurements to a second network entity. For example, the UEmay disregard (e.g., discarded) all SPS signals, or all SPS signals in aparticular frequency band (for a satellite, a constellation, or a set ofconstellation), or all measurements from a particular constellation or aset of constellations, or any combination of these. As another example,the UE 500 may use one or more base station signal measurements, thatthe UE would not otherwise use absent determining that the first SPSsignal is anomalous, to determine the position of the UE 500, or mayweight more heavily one or more base station signal measurements thatthe UE 500 would already use to determine the position of the UE 500.Sending the set of SPS signal measurements to a network entity may helpprevent use of inaccurate information (e.g., falsified base stationsignals or identified location) to authorize actions (e.g., financialtransactions), e.g., because simulating SPS signals, especially formultiple constellations, may be much more difficult than falsifying someinformation such as simulating a base station signal, or simulating afew SPS signals from a single constellation, or injecting a falselocation indication into a communication.

Referring to FIG. 11, with further reference to FIGS. 1-10, a method1100 of processing positioning signals including an alleged satellitepositioning signal that is spoofed includes the stages shown. The method1100 is, however, an example only and not limiting. The method 1100 maybe altered, e.g., by having stages added, removed, rearranged, combined,performed concurrently, and/or having single stages split into multiplestages.

At stage 1110, the method 1100 includes measuring a plurality ofpositioning signals, including the alleged satellite positioning signal,to produce a plurality of positioning signal measurements including afirst positioning signal measurement of the alleged satellitepositioning signal and a second positioning signal measurement of one ofthe plurality of positioning signals other than the alleged satellitepositioning signal. For example, the SPS receiver 515 receives andmeasures SPS signals including a spoofed SPS signal to producemeasurements of the SPS signals. The SPS receiver 515, possibly incombination with the processor 510 (possibly in combination with thememory 530), may comprise means for measuring the plurality ofpositioning signals.

At stage 1120, the method 1100 includes determining a difference betweenthe first positioning signal measurement and the second positioningsignal measurement. For example, the anomaly detection unit 550 comparespositioning signal measurements determined by the SPS receiver 515and/or the processor 510 and determines a difference between themeasurements. The processor 510 (possibly in combination with the memory530), may comprise means for determining a difference between the firstand second positioning signal measurements.

At stage 1130, the method 1100 includes determining that the differenceis greater than a threshold difference. For example, the anomalydetection unit 550 compares the determined difference with acorresponding threshold (e.g., time threshold, power threshold, etc.)and determines that the difference exceeds the corresponding threshold.The processor 510 (possibly in combination with the memory 530), maycomprise means for determining that the difference is greater than athreshold difference.

At stage 1140, the method 1100 includes determining a location of theuser equipment using at least one location-determining measurement ofthe plurality of positioning signal measurements while, in response todetermining that the difference is greater than the thresholddifference, excluding the first positioning signal measurement from theat least one location-determining measurement. For example, the locationdetermination unit 560 disregards the positioning signal measurementcorresponding to the alleged satellite positioning signal, and uses oneor more other positioning signal measurements (e.g., of one or moresatellite positioning signals and/or one or more other positioningsignals (e.g., from one or more base stations)) to determine a locationof the UE 500. The processor 510, possibly in combination with thememory 530, possibly in combination with the interface 520 (e.g., thewireless receiver 244 and the antenna 246) may comprise means fordetermining a location of the UE.

Referring to FIG. 12, with further reference to FIGS. 1-10, a method1200 for determining, at a user equipment, that an at least one allegedsatellite positioning signal is spoofed includes the stages shown. Themethod 1200 is, however, an example only and not limiting. The method1200 may be altered, e.g., by having stages added, removed, rearranged,combined, performed concurrently, and/or having single stages split intomultiple stages.

At stage 1210, the method 1200 includes measuring a plurality oflocation signals including at least one alleged satellite positioningsignal that is spoofed. For example, the SPS receiver 515 receives andmeasures one or more SPS signals including a spoofed SPS signal toproduce measurements of the SPS signals. The processor 510 may alsomeasure one or more other locations signals (e.g., DL-PRS) to produceone or more other measurements. The SPS receiver 515, possibly incombination with the processor 510 (possibly in combination with thememory 530 and/or the interface 520), may comprise means for measuringthe plurality of location signals.

At stage 1220, the method 1200 includes determining a difference betweenat least one measurement of the at least one alleged satellitepositioning signal and at least one expected satellite positioningsignal measurement. For example, the anomaly detection unit 550 comparesone or more measurements of the spoofed SPS signal with one or moreexpected SPS signal measurements that is(are) expected to be similar tothe measurement(s) of the spoofed SPS signal if the spoofed SPS signalwas not spoofed. The expected measurement(s) may be, for example,determined from one or more other locations signals (e.g., SPSsignal(s), base station signal(s), etc.) and/or other information (e.g.,SV location information, sensor information (e.g., dead-reckoninginformation, etc.). The processor 510 (possibly in combination with thememory 530 and/or the interface 520), may comprise means for determininga difference between the at least one measurement of the at least onealleged satellite positioning signal and the at least one expectedsatellite positioning signal measurement.

At stage 1230, the method 1200 includes determining that the differenceis greater than a threshold difference. For example, the anomalydetection unit 550 compares the determined difference with acorresponding threshold (e.g., time threshold, power threshold, etc.)and determines that the difference exceeds the corresponding threshold.The processor 510 (possibly in combination with the memory 530), maycomprise means for determining that the difference is greater than athreshold difference.

At stage 1240, the method 1200 includes determining a location of theuser equipment using measurements of the plurality of location signalswhile excluding the at least one measurement of the at least one allegedsatellite positioning signal. For example, the location determinationunit 560 disregards the positioning signal measurement corresponding tothe alleged satellite positioning signal, and uses one or more otherpositioning signal measurements (e.g., of one or more satellitepositioning signals and/or one or more other positioning signals (e.g.,from one or more base stations)) to determine a location of the UE 500.The processor 510, possibly in combination with the memory 530, possiblyin combination with the interface 520 (e.g., the wireless receiver 244and the antenna 246) may comprise means for determining a location ofthe UE.

Other Considerations

Other examples and implementations are within the scope of thedisclosure and appended claims. For example, due to the nature ofsoftware and computers, functions described above can be implementedusing software executed by a processor, hardware, firmware, hardwiring,or a combination of any of these. Features implementing functions mayalso be physically located at various positions, including beingdistributed such that portions of functions are implemented at differentphysical locations. A statement that a feature that may implement afunction includes that the feature may be configured to implement thefunction (e.g., a statement that an item may perform function X includesthat the item may be configured to perform function X). Components,functional or otherwise, shown in the figures and/or discussed herein asbeing connected or communicating with each other are communicativelycoupled unless otherwise noted. That is, they may be directly orindirectly connected to enable communication between them.

As used herein, the singular forms “a,” “an,” and “the” include theplural forms as well, unless the context clearly indicates otherwise.The terms “comprises,” “comprising,” “includes,” and/or “including,” asused herein, specify the presence of stated features, integers, steps,operations, elements, and/or components, but do not preclude thepresence or addition of one or more other features, integers, steps,operations, elements, components, and/or groups thereof.

Also, as used herein, “or” as used in a list of items (possibly prefacedby “at least one of” or prefaced by “one or more of”) indicates adisjunctive list such that, for example, a list of “at least one of A,B, or C,” or a list of “one or more of A, B, or C” or a list of “A or Bor C” means A, or B, or C, or AB (A and B), or AC (A and C), or BC (Band C), or ABC (i.e., A and B and C), or combinations with more than onefeature (e.g., AA, AAB, ABBC, etc.). Thus, a recitation that an item,e.g., a processor, is configured to perform a function regarding atleast one of A or B, or a recitation that an item is configured toperform a function A or a function B, means that the item may beconfigured to perform the function regarding A, or may be configured toperform the function regarding B, or may be configured to perform thefunction regarding A and B. For example, a phrase of “a processorconfigured to measure at least one of A or B” or “a processor configuredto measure A or measure B” means that the processor may be configured tomeasure A (and may or may not be configured to measure B), or may beconfigured to measure B (and may or may not be configured to measure A),or may be configured to measure A and measure B (and may be configuredto select which, or both, of A and B to measure). Similarly, arecitation of a means for measuring at least one of A or B includesmeans for measuring A (which may or may not be able to measure B), ormeans for measuring B (and may or may not be configured to measure A),or means for measuring A and B (which may be able to select which, orboth, of A and B to measure). As another example, a recitation that anitem, e.g., a processor, is configured to at least one of performfunction X or perform function Y means that the item may be configuredto perform the function X, or may be configured to perform the functionY, or may be configured to perform the function X and to perform thefunction Y. For example, a phrase of “a processor configured to at leastone of measure X or measure Y” means that the processor may beconfigured to measure X (and may or may not be configured to measure Y),or may be configured to measure Y (and may or may not be configured tomeasure X), or may be configured to measure X and to measure Y (and maybe configured to select which, or both, of X and Y to measure).

Substantial variations may be made in accordance with specificrequirements. For example, customized hardware might also be used,and/or particular elements might be implemented in hardware, software(including portable software, such as applets, etc.) executed by aprocessor, or both. Further, connection to other computing devices suchas network input/output devices may be employed.

As used herein, unless otherwise stated, a statement that a function oroperation is “based on” an item or condition means that the function oroperation is based on the stated item or condition and may be based onone or more items and/or conditions in addition to the stated item orcondition.

The systems and devices discussed above are examples. Variousconfigurations may omit, substitute, or add various procedures orcomponents as appropriate. For instance, features described with respectto certain configurations may be combined in various otherconfigurations. Different aspects and elements of the configurations maybe combined in a similar manner. Also, technology evolves and, thus,many of the elements are examples and do not limit the scope of thedisclosure or claims.

A wireless communication system is one in which communications areconveyed wirelessly, i.e., by electromagnetic and/or acoustic wavespropagating through atmospheric space rather than through a wire orother physical connection. A wireless communication network may not haveall communications transmitted wirelessly, but is configured to have atleast some communications transmitted wirelessly. Further, the term“wireless communication device,” or similar term, does not require thatthe functionality of the device is exclusively, or evenly primarily, forcommunication, or that the device be a mobile device, but indicates thatthe device includes wireless communication capability (one-way ortwo-way), e.g., includes at least one radio (each radio being part of atransmitter, receiver, or transceiver) for wireless communication.

Specific details are given in the description to provide a thoroughunderstanding of example configurations (including implementations).However, configurations may be practiced without these specific details.For example, well-known circuits, processes, algorithms, structures, andtechniques have been shown without unnecessary detail in order to avoidobscuring the configurations. This description provides exampleconfigurations only, and does not limit the scope, applicability, orconfigurations of the claims. Rather, the preceding description of theconfigurations provides a description for implementing describedtechniques. Various changes may be made in the function and arrangementof elements without departing from the scope of the disclosure.

The terms “processor-readable medium,” “machine-readable medium,” and“computer-readable medium,” as used herein, refer to any medium thatparticipates in providing data that causes a machine to operate in aspecific fashion. Using a computing platform, various processor-readablemedia might be involved in providing instructions/code to processor(s)for execution and/or might be used to store and/or carry suchinstructions/code (e.g., as signals). In many implementations, aprocessor-readable medium is a physical and/or tangible storage medium.Such a medium may take many forms, including but not limited to,non-volatile media and volatile media. Non-volatile media include, forexample, optical and/or magnetic disks. Volatile media include, withoutlimitation, dynamic memory.

Having described several example configurations, various modifications,alternative constructions, and equivalents may be used without departingfrom the disclosure. For example, the above elements may be componentsof a larger system, wherein other rules may take precedence over orotherwise modify the application of the invention. Also, a number ofoperations may be undertaken before, during, or after the above elementsare considered. Accordingly, the above description does not bound thescope of the claims.

A statement that a value exceeds (or is more than or above) a firstthreshold value is equivalent to a statement that the value meets orexceeds a second threshold value that is slightly greater than the firstthreshold value, e.g., the second threshold value being one value higherthan the first threshold value in the resolution of a computing system.A statement that a value is less than (or is within or below) a firstthreshold value is equivalent to a statement that the value is less thanor equal to a second threshold value that is slightly lower than thefirst threshold value, e.g., the second threshold value being one valuelower than the first threshold value in the resolution of a computingsystem.

1. A user equipment comprising: an SPS receiver (Satellite PositioningSystem receiver) to receive satellite positioning system signalsincluding a first SPS signal; a memory; and a processor communicativelycoupled to the memory and to the SPS receiver, to receive SPS signalsfrom the SPS receiver, and configured to: determine whether the firstSPS signal is anomalous by being configured to at least one of: (1)determine a first SPS signal measurement of the first SPS signal, afirst format of the first SPS signal corresponding to a first SV(satellite vehicle); determine a second SPS signal measurement of asecond SPS signal, the second SPS signal being separate from the firstSPS signal, and a second format of the second SPS signal correspondingto a second SV; and determine whether an actual measurement differencebetween the first SPS signal measurement and the second SPS signalmeasurement is consistent with an expected measurement differencebetween expected SPS signals from the first SV and the second SV; or (2)determine whether a received power of the first SPS signal exceeds amaximum expected SPS signal received power; or (3) determine whether thefirst SPS signal originated from an SV location consistent with first SVlocation information for the first SV comprising first ephemeris datafor the first SV, first orbital information for the first SV, or acombination thereof; or (4) determine whether a first pseudorange, basedon the first SPS signal, to the first SV differs by more than a firstpseudorange threshold from an expected pseudorange to the first SV basedon a time-filtered location of the user equipment determined by theprocessor; or (5) determine that a first location, of the userequipment, based on the first SPS signal measurement corresponds to atleast one of an unexpected location or a high likelihood of anomalylocation; or (6) determine whether one or more base station signalmeasurements are consistent with the first SPS signal measurement; or(7) a measured signal quality of the first SPS signal is consistent withan expected signal quality.
 2. The user equipment of claim 1, wherein todetermine whether the first SPS signal is anomalous, the processor isconfigured to determine whether an actual power difference between afirst power of the first SPS signal measurement and a second power ofthe second SPS signal measurement differs from an expected powerdifference by more than a first power threshold.
 3. The user equipmentof claim 1, wherein the processor is configured in accordance with (1)and is configured to select the first SPS signal and the second SPSsignal such that: the first SPS signal has a first carrier frequency,the second SPS signal has a second carrier frequency that is differentfrom the first carrier frequency, and the first SV and the second SV arethe same SV; or the first SV is in a separate constellation from thesecond SV.
 4. The user equipment of claim 1, wherein the processor isconfigured in accordance with (1) and is configured to determine theexpected measurement difference based on the first SV locationinformation for the first SV and based on second SV location informationfor the second SV.
 5. The user equipment of claim 1, wherein todetermine whether the first SPS signal is anomalous, the processor isconfigured to determine whether an actual pseudorange difference,between the first pseudorange based on the first SPS signal and a secondpseudorange based on the second SPS signal, differs from an expectedpseudorange difference by more than a second pseudorange threshold. 6.The user equipment of claim 1, wherein the processor is configured inaccordance with (1), the first SPS signal measurement is a first time,and the second SPS signal measurement is a second time.
 7. The userequipment of claim 1, wherein the processor is configured to respond toan initial determination that the first SPS signal is anomalous bydetermining whether the first SPS signal is anomalous based on a thirdSPS signal that is different from any SPS signal on which the initialdetermination was based.
 8. The user equipment of claim 7, wherein theprocessor is configured to select the third SPS signal such that a thirdformat of the third SPS signal corresponds to a third SV that is part ofa satellite vehicle constellation that excludes the first SV.
 9. Theuser equipment of claim 1, wherein the processor is configured torespond to determining that the first SPS signal is anomalous bydetermining whether the first SPS signal is anomalous based on at leastone technology other than SPS technology.
 10. The user equipment ofclaim 8, wherein the processor is configured to determine at least oneof how many other SV signals or what other technologies to use based ona security level of knowledge of a position of the user equipment. 11.The user equipment of claim 1, further comprising at least one motionsensor communicatively coupled to the processor, wherein the processoris configured to determine, based on at least one sensor measurementfrom the at least one motion sensor, a dead-reckoning position of theuser equipment and to determine whether the first SPS signal isanomalous in response to at least one of the first SPS signalmeasurement and the second SPS signal measurement being inconsistentwith the dead-reckoning position of the user equipment.
 12. The userequipment of claim 1, wherein the processor is configured to respond todetermining that the first SPS signal is anomalous by at least one of:disregarding the first SPS signal to determine a position of the userequipment; or disregarding the first pseudorange based on the first SPSsignal to determine the position of the user equipment; or de-weightingthe first SPS signal to determine the position of the user equipment; orde-weighting the first pseudorange based on the first SPS signal todetermine the position of the user equipment; or using the one or morebase station signal measurements to determine the position of the userequipment; or increasing one or more weightings of the one or more basestation signal measurements to determine the position of the userequipment; or sending an anomaly indication, indicating that the firstSPS signal is anomalous, to a first network entity; or sending a set ofSPS signal measurements to a second network entity.
 13. A user equipmentcomprising: signal receiving means for receiving SPS signals including afirst SPS signal (Satellite Positioning System signal); and anomalymeans for determining whether the first SPS signal is anomalous, theanomaly means comprising at least one of: measurement difference meansfor: determining a first SPS signal measurement of the first SPS signalfrom the signal receiving means and having a first format correspondingto a first SV (satellite vehicle); determining a second SPS signalmeasurement of a second SPS signal from the signal receiving means andhaving a second format corresponding to a second SV; and determiningwhether an actual measurement difference between the first SPS signalmeasurement and the second SPS signal measurement is consistent with anexpected measurement difference between expected SPS signals from thefirst SV and the second SV; or expectation means for determining whethera received power of the first SPS signal exceeds a maximum expected SPSsignal received power; or origination means for determining whether thefirst SPS signal originated from an SV location consistent with first SVlocation information for the first SV comprising first ephemeris datafor the first SV, first orbital information for the first SV, or acombination thereof; or pseudorange means for determining whether afirst pseudorange, based on the first SPS signal, to the first SVdiffers by more than a first pseudorange threshold from an expectedpseudorange to the first SV based on a time-filtered location of theuser equipment; or location/likelihood means for determining that afirst location, of the user equipment, based on the first SPS signalmeasurement corresponds to at least one of an unexpected location or ahigh likelihood of anomaly location; or means for determining whetherone or more base station signal measurements are consistent with thefirst SPS signal measurement; or means for determining whether ameasured signal quality of the first SPS signal is consistent with anexpected signal quality.
 14. The user equipment of claim 13, wherein theanomaly means comprise the measurement difference means, and themeasurement difference means are for determining whether an actual powerdifference between a first power of the first SPS signal measurement anda second power of the second SPS signal measurement differs from anexpected power difference by more than a first power threshold.
 15. Theuser equipment of claim 13, wherein the user equipment comprises themeasurement difference means and the measurement difference means arefor selecting the first SPS signal and the second SPS signal such that:the first SPS signal has a first carrier frequency, the second SPSsignal has a second carrier frequency that is different from the firstcarrier frequency, and the first SV and the second SV are the same SV;or the first SV is in a separate constellation from the second SV. 16.The user equipment of claim 13, wherein the user equipment comprises themeasurement difference means and the measurement difference means arefor determining the expected measurement difference based on the firstSV location information for the first SV and based on second SV locationinformation for the second SV.
 17. The user equipment of claim 13,wherein the anomaly means comprise the measurement difference means, andthe measurement difference means are for determining whether an actualpseudorange difference, between the first pseudorange based on the firstSPS signal and a second pseudorange based on the second SPS signal,differs from an expected pseudorange difference by more than a secondpseudorange threshold.
 18. The user equipment of claim 13, wherein theanomaly means comprise the measurement difference means, the first SPSsignal measurement is a first time, and the second SPS signalmeasurement is a second time.
 19. The user equipment of claim 13,wherein the anomaly means are for responding to an initial determinationthat the first SPS signal is anomalous by determining whether the firstSPS signal is anomalous based on a third SPS signal that is differentfrom any SPS signal on which the initial determination was based. 20.The user equipment of claim 19, wherein the anomaly means are forselecting the third SPS signal such that a third format of the third SPSsignal corresponds to a third SV that is part of a satellite vehicleconstellation that excludes the first SV.
 21. The user equipment ofclaim 13, wherein the anomaly means are for responding to an initialdetermination that the first SPS signal is anomalous by determiningwhether the first SPS signal is anomalous based on at least onetechnology other than SPS technology.
 22. The user equipment of claim21, wherein the anomaly means are for determining at least one of howmany other SV signals or what other technologies to use based on asecurity level of knowledge of a position of the user equipment.
 23. Theuser equipment of claim 13, wherein the anomaly means comprise themeasurement difference means, and the measurement difference means arefor determining a dead-reckoning position of the user equipment, andwherein the anomaly means are for determining whether the first SPSsignal is anomalous in response to at least one of the first SPS signalmeasurement and the second SPS signal measurement being inconsistentwith the dead-reckoning position of the user equipment.
 24. The userequipment of claim 13, further comprising at least one of: positiondetermination means for determining a position of the user equipment byresponding to determining that the first SPS signal is anomalous by atleast one of: disregarding the first SPS signal to determine theposition of the user equipment; or disregarding the first pseudorangebased on the first SPS signal to determine the position of the userequipment; or de-weighting the first SPS signal to determine theposition of the user equipment; or de-weighting the first pseudorangebased on the first SPS signal to determine the position of the userequipment; or using the one or more base station signal measurements todetermine the position of the user equipment; or increasing one or moreweightings of the one or more base station signal measurements todetermine the position of the user equipment; or first sending means forresponding to determining that the first SPS signal is anomalous bysending an anomaly indication, indicating that the first SPS signal isanomalous, to a first network entity; or second sending means forresponding to determining that the first SPS signal is anomalous bysending a set of SPS signal measurements to a second network entity. 25.A method of detecting an anomalous SPS signal (Satellite PositioningSystem signal), the method comprising: receiving, at a user equipment, afirst SPS signal; and determining, at the user equipment, whether thefirst SPS signal is anomalous by at least one of: determining whether anactual measurement difference, between a first SPS signal measurement ofthe first SPS signal and a second SPS signal measurement of a second SPSsignal, is consistent with an expected measurement difference betweenexpected SPS signals from a first SV (satellite vehicle) and a secondSV, wherein the first SPS signal has a first format corresponding to thefirst SV and the second SPS signal has a second format corresponding tothe second SV; or determining whether a received power of the first SPSsignal exceeds a maximum expected SPS signal received power; ordetermining whether the first SPS signal originated from an SV locationconsistent with first SV location information for the first SVcomprising first ephemeris data for the first SV, first orbitalinformation for the first SV, or a combination thereof; or determiningwhether a first pseudorange, based on the first SPS signal, to the firstSV differs by more than a first pseudorange threshold from an expectedpseudorange to the first SV based on a time-filtered location of theuser equipment; or determining that a first location, of the userequipment, based on the first SPS signal measurement corresponds to atleast one of an unexpected location or a high likelihood of anomalylocation; or determining whether one or more base station signalmeasurements are consistent with the first SPS signal measurement; ordetermining whether a measured signal quality of the first SPS signal isconsistent with an expected signal quality.
 26. The method of claim 25,wherein determining whether the first SPS signal is anomalous comprisesdetermining whether the actual measurement difference is consistent withthe expected measurement difference by determining whether an actualpower difference between a first power of the first SPS signalmeasurement and a second power of the second SPS signal measurementdiffers from an expected power difference by more than a first powerthreshold.
 27. The method of claim 25, wherein determining whether thefirst SPS signal is anomalous comprises determining whether the actualmeasurement difference is consistent with the expected measurementdifference, the method further comprising selecting the first SPS signaland the second SPS signal such that: the first SPS signal has a firstcarrier frequency, the second SPS signal has a second carrier frequencythat is different from the first carrier frequency, and the first SV andthe second SV are the same SV; or the first SV is in a separateconstellation from the second SV.
 28. The method of claim 25, whereindetermining whether the first SPS signal is anomalous comprisesdetermining whether the actual measurement difference is consistent withthe expected measurement difference, the method further comprisingdetermining the expected measurement difference based on the first SVlocation information for the first SV and based on second SV locationinformation for the second SV.
 29. The method of claim 25, whereindetermining whether the first SPS signal is anomalous comprisesdetermining whether the actual measurement difference is consistent withthe expected measurement difference by determining whether an actualpseudorange difference, between the first pseudorange based on the firstSPS signal and a second pseudorange based on the second SPS signal,differs from an expected pseudorange difference by more than a secondpseudorange threshold.
 30. The method of claim 25, wherein the methodcomprises determining whether the actual measurement difference isconsistent with the expected measurement difference, the first SPSsignal measurement is a first time, and the second SPS signalmeasurement is a second time.
 31. The method of claim 25, furthercomprising responding to an initial determination that the first SPSsignal is anomalous by determining whether the first SPS signal isanomalous based on a third SPS signal that is different from any SPSsignal on which the initial determination was based.
 32. The method ofclaim 31, further comprising selecting the third SPS signal such that athird format of the third SPS signal corresponds to a third SV that ispart of a satellite vehicle constellation that excludes the first SV.33. The method of claim 25, further comprising responding to an initialdetermination that the first SPS signal is anomalous by determiningwhether the first SPS signal is anomalous based on at least onetechnology other than SPS technology.
 34. The method of claim 33,further comprising determining at least one of how many other SV signalsor what other technologies to use, for determining whether the first SPSsignal is anomalous, based on a security level of knowledge of aposition of the user equipment.
 35. The method of claim 25, furthercomprising determining a dead-reckoning position of the user equipment,wherein determining whether the first SPS signal is anomalous isperformed in response to at least one of the first SPS signalmeasurement and the second SPS signal measurement being inconsistentwith the dead-reckoning position of the user equipment.
 36. The methodof claim 25, further comprising responding to determining that the firstSPS signal is anomalous by at least one of: disregarding the first SPSsignal to determine a position of the user equipment; or disregardingthe first pseudorange based on the first SPS signal to determine theposition of the user equipment; or de-weighting the first SPS signal todetermine the position of the user equipment; or de-weighting the firstpseudorange based on the first SPS signal to determine the position ofthe user equipment; or using the one or more base station signalmeasurements to determine the position of the user equipment; orincreasing one or more weightings of the one or more base station signalmeasurements to determine the position of the user equipment; or sendingan anomaly indication, indicating that the first SPS signal isanomalous, to a first network entity; or sending a set of SPS signalmeasurements to a second network entity.
 37. A non-transitory,processor-readable storage medium comprising processor-readableinstructions configured to cause a processor of a user equipment to:determine whether a first SPS signal (Satellite Positioning Systemsignal) is anomalous by causing the processor to at least one of: (1)determine a first SPS signal measurement of the first SPS signal, afirst format of the first SPS signal corresponding to a first SV(satellite vehicle); determine a second SPS signal measurement of asecond SPS signal, the second SPS signal being separate from the firstSPS signal, and a second format of the second SPS signal correspondingto a second SV; and determine whether an actual measurement differencebetween the first SPS signal measurement and the second SPS signalmeasurement is consistent with an expected measurement differencebetween expected SPS signals from the first SV and the second SV; or (2)determine whether a received power of the first SPS signal exceeds amaximum expected SPS signal received power; or (3) determine whether thefirst SPS signal originated from an SV location consistent with first SVlocation information for the first SV comprising first ephemeris datafor the first SV, first orbital information for the first SV, or acombination thereof; or (4) determine whether a first pseudorange, basedon the first SPS signal, to the first SV differs by more than a firstpseudorange threshold from an expected pseudorange to the first SV basedon a time-filtered location of the user equipment determined by theprocessor; or (5) determine that a first location, of the userequipment, based on the first SPS signal measurement corresponds to atleast one of an unexpected location or a high likelihood of anomalylocation; or (6) determine whether one or more base station signalmeasurements are consistent with the first SPS signal measurement; or(7) determine whether a measured signal quality of the first SPS signalis consistent with an expected signal quality.
 38. The storage medium ofclaim 37, wherein the instructions configured to cause the processor todetermine whether the first SPS signal is anomalous compriseinstructions configured to cause the processor to determine whether anactual power difference between a first power of the first SPS signalmeasurement and a second power of the second SPS signal measurementdiffers from an expected power difference by more than a first powerthreshold.
 39. The storage medium of claim 37, wherein the instructionsconfigured to cause the processor to determine whether the first SPSsignal is anomalous in accordance with (1), and wherein the instructionscomprise instructions configured to cause the processor to select thefirst SPS signal and the second SPS signal such that: the first SPSsignal has a first carrier frequency, the second SPS signal has a secondcarrier frequency that is different from the first carrier frequency,and the first SV and the second SV are the same SV; or the first SV isin a separate constellation from the second SV.
 40. The storage mediumof claim 37, wherein the instructions configured to cause the processorto determine whether the first SPS signal is anomalous in accordancewith (1), and wherein the instructions comprise instructions configuredto cause the processor to determine the expected measurement differencebased on the first SV location information for the first SV and based onsecond SV location information for the second SV.
 41. The storage mediumof claim 37, wherein the instructions configured to cause the processorto determine whether the first SPS signal is anomalous compriseinstructions configured to cause the processor to determine whether anactual pseudorange difference, between the first pseudorange based onthe first SPS signal and a second pseudorange based on the second SPSsignal, differs from an expected pseudorange difference by more than asecond pseudorange threshold.
 42. The storage medium of claim 37,wherein the instructions comprise the instructions configured to causethe processor to determine whether the first SPS signal is anomalous bycausing the processor to determine whether the actual measurementdifference between the first SPS signal measurement and the second SPSsignal measurement is consistent with the expected measurementdifference, the first SPS signal measurement is a first time, and thesecond SPS signal measurement is a second time.
 43. The storage mediumof claim 37, wherein the instructions comprise instructions configuredto cause the processor to respond to an initial determination that thefirst SPS signal is anomalous by determining whether the first SPSsignal is anomalous based on a third SPS signal that is different fromany SPS signal on which the initial determination was based.
 44. Thestorage medium of claim 43, wherein the instructions compriseinstructions configured to cause the processor to select the third SPSsignal such that a third format of the third SPS signal corresponds to athird SV that is part of a satellite vehicle constellation that excludesthe first SV.
 45. The storage medium of claim 37, wherein theinstructions comprise instructions configured to cause the processor torespond to determining that the first SPS signal is anomalous bydetermining whether the first SPS signal is anomalous based on at leastone technology other than SPS technology.
 46. The storage medium ofclaim 45, wherein the instructions comprise instructions configured tocause the processor to determine at least one of how many other SVsignals or what other technologies to use based on a security level ofknowledge of a position of the user equipment.
 47. The storage medium ofclaim 37, wherein the instructions comprise instructions configured tocause the processor to determine a dead-reckoning position of the userequipment, and wherein the instructions are configured to cause theprocessor to determine whether the first SPS signal is anomalous inresponse to at least one of the first SPS signal measurement and thesecond SPS signal measurement being inconsistent with the dead-reckoningposition of the user equipment.
 48. The storage medium of claim 37,wherein the instructions comprise instructions configured to cause theprocessor to respond to determining that the first SPS signal isanomalous by at least one of: disregarding the first SPS signal todetermine a position of the user equipment; or disregarding the firstpseudorange based on the first SPS signal to determine the position ofthe user equipment; or de-weighting the first SPS signal to determinethe position of the user equipment; or de-weighting the firstpseudorange based on the first SPS signal to determine the position ofthe user equipment; or using the one or more base station signalmeasurements to determine the position of the user equipment; orincreasing one or more weightings of the one or more base station signalmeasurements to determine the position of the user equipment; or sendingan anomaly indication, indicating that the first SPS signal isanomalous, to a first network entity; or sending a set of SPS signalmeasurements to a second network entity.
 49. A user equipmentcomprising: an SPS receiver (Satellite Positioning System receiver) toreceive satellite positioning system signals; a communicationtransmitter; a memory; and a processor communicatively coupled to thememory, to the SPS receiver to receive SPS signals from the SPSreceiver, and to the communication transmitter to convey communicationsignals wirelessly, the processor being configured to respond to arequest for authorization for a financial transaction by conveying, viathe communication transmitter to a network entity: a plurality of SPSmeasurements corresponding to a plurality of SPS signals; identities ofsatellite vehicles corresponding to the plurality of SPS signals; aposition of the user equipment based on a positioning technique otherthan an SPS positioning technique; and a timestamp.
 50. The userequipment of claim 49, wherein the processor is configured to encryptthe plurality of SPS measurements.
 51. The user equipment of claim 49,wherein the plurality of SPS measurements comprise pseudoranges.
 52. Theuser equipment of claim 49, wherein the plurality of SPS measurementscomprise raw measurements of the plurality of SPS signals.
 53. A method,at a user equipment, of processing positioning signals including analleged satellite positioning signal that is spoofed, the methodcomprising: measuring a plurality of positioning signals, including thealleged satellite positioning signal, to produce a plurality ofpositioning signal measurements including a first positioning signalmeasurement of the alleged satellite positioning signal and a secondpositioning signal measurement of one of the plurality of positioningsignals other than the alleged satellite positioning signal; determininga difference between the first positioning signal measurement and thesecond positioning signal measurement; determining that the differenceis greater than a threshold difference; and determining a location ofthe user equipment using at least one location-determining measurementof the plurality of positioning signal measurements while, in responseto determining that the difference is greater than the thresholddifference, excluding the first positioning signal measurement from theat least one location-determining measurement.
 54. A positioning methodat a user equipment, the positioning method comprising: measuring aplurality of location signals including at least one alleged satellitepositioning signal that is spoofed; determining a difference between atleast one measurement of the at least one alleged satellite positioningsignal and at least one expected satellite positioning signalmeasurement; determining that the difference is greater than a thresholddifference; and determining a location of the user equipment usingmeasurements of the plurality of location signals while excluding the atleast one measurement of the at least one alleged satellite positioningsignal.